BoldSign vs Youtrust

BoldSign 78

Read as a closed service. The API changelog's newest entry is 16 October 2026, and the PHP SDK repository was pushed the same day, Java and Python on 13 October (30). Changelog entries on 13 August, 19 August, 7 September, 23 September, 8 October and 16 October 2026 (20). Support site, knowledge base and support@boldsign.com, with a public changelog. GitHub issues on the SDK repositories were not read (8 of 15). Five official SDKs, Node at 3.3.4 since August 2026. The hosted MCP server is not in the official MCP registry (15). The Node SDK clone shows no CI workflow and the deprecated MCP package stopped at 0.0.5 (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.

Youtrust 61

Read as a closed service. The changelog's newest entries are dated 21 October 2026 (30). Ten entries between 13 and 21 October 2026 (20). A help centre, contact@youtrust.com in the OpenAPI contact block, a changelog RSS feed and a feedback form for the AI connector. No public issue tracker (8 of 15). No official SDK; the GitHub organisation holds no client library and the docs point to generators and Postman (0 of 15). The OpenAPI file is current with the October changes and the MCP setup page was updated on 7 September 2026 (3 of 10). 30 + 20 + 8 + 0 + 3 = 61.

BoldSign 85

A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.

Youtrust 90

A public OpenAPI 3.0.0 file with 178 operations on 114 paths, a bearer scheme and 282 enums (25). developers.youtrust.com serves llms.txt, a per-section llms.txt and a Markdown twin of every page (10). Every operation has a description, 28 of them under 40 characters, and the guides explain the signature request lifecycle, when to use templates and the Tolerant Reader rule (14 of 20). Required fields, 282 enums, a Safe String type with stated rules, and a free-form metadata object (13 of 15). 1,307 examples in the file, every operation documents 400, 401, 403, 404, 405, 429 and 500, the error page gives the type, detail and invalid_params shape with retry guidance per code, and a list of error types is published (15). v3 in the path, a versioning page with compatibility rules, a Deprecated tag in the file, and a changelog with ten entries dated 13 to 21 October 2026 and an RSS feed, with no removal timeline (13 of 15). 25 + 10 + 14 + 13 + 15 + 13 = 90.

BoldSign 63

OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.

Youtrust 68

Bearer API keys with an Organization or Workspace scope and a Read-Only or Full-Access permission, separate per environment, created only by Admins and Owners, and OAuth for the AI connector with revocation in account settings. No expiry or rotation guidance found (26 of 30). Read-Only keys, workspace scoping, draft-then-activate, and the AI connector's examples ask before sending. The Developer MCP's execute-request runs any call with the key's full permissions, activation, cancellation and deletion included, and the API has no approval step (14 of 20). Signer names, field answers and documents return through the API, Safe String rules strip HTML, URLs and email addresses from inputs, and no injection guidance was found (4 of 15). Audit trails per signature request and signer, downloadable, plus consumption records; no log of API calls or key use was found (8 of 15). PGP-signed security.txt, a bug bounty and annual technical audits on the security page, eIDAS certification as a trust service provider, hosting in France. ISO 27001 was not named on the pages read (16 of 20). 26 + 14 + 4 + 8 + 16 = 68.

BoldSign 77

Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59.

Youtrust 72

Closed service under Terms of Use and Subscription updated 2 July 2026 that name Youtrust SAS under French law, with the previous version linked. The OpenAPI file's licence reads proprietary (15 of 30). The privacy policy names Youtrust SAS of Caen, lists retention periods by purpose (the contract term plus five years in France and ten in Germany and Italy for some records), links a list of subprocessors, and the security page says hosting is exclusively in France with evidence files archived at Arkhinéo (22 of 30). The versioning page says deprecated endpoints and properties keep working and are not planned for removal, compatible changes arrive without notice, and the terms describe an end-of-life notice for old platform versions with no period (10 of 20). A subprocessor list is linked from the privacy policy, hosting is in France at AWS EMEA's French branch per the legal notice, and no notice period for new subprocessors was found (17 of 20). 15 + 22 + 10 + 17 = 64.