DocuSeal vs Youtrust

DocuSeal 50

Graded as a hosted service, on the DocuSeal Cloud REST API, as documenso is on its cloud API. status.docuseal.net on Better Stack tracks docuseal.com, docuseal.eu, both API hosts and custom domains (20). Two incidents in the 90 days to 2 November 2026, both partial. Email and webhook deliveries were delayed for 37 minutes on 10 August (01:04 to 01:41 UTC), and SMS delivery to Austrian (+43) numbers was delayed on 1 November, per the feed re-read on 2 November (20). No rate limit numbers were found in the API reference, the OpenAPI file or the terms, whose fair use section says there are no fixed limits (0). No 429 or retry guidance and no idempotency key were found. The open-source code answers 429 with Too many requests (0). No SLA found. The security page states a goal of 99.99 per cent availability, which is not a commitment (0). The API is generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.

Youtrust 85

Read with the hosted lines and scored on the Public API v3 at api.yousign.app, the surface both MCP servers call. yousign.statuspage.io on Atlassian Statuspage has an incident history and a feed (20). Between 5 August and 3 November 2026 the feed records HTTP 500 errors on the public API from 11:24 to 11:35 and 14:42 to 15:19 CEST on 7 October, caused by an infrastructure provider; about 45 minutes of delayed advanced and unavailable qualified signatures on 13 August; identity verification delays at a third-party provider on 1 September (most of a day), 2 September, 14 September and 16 October (33 minutes); 16 minutes of delayed seals on 16 October; email delays to Microsoft mailboxes on 4 September; and Orange network routing on 2 October. Several incidents, mostly at identity providers, and no outage of the core API over an hour (20). Rate limits are published per minute and hour for each environment (15). 429 answers Too many requests with x-ratelimit headers and a Ratelimit-Reset in seconds, the docs say to slow down and increase the delay, and there are no idempotency keys and no Retry-After (10 of 15). The API pricing page states 99 per cent and 99.9 per cent SLAs on the Plus and Pro plans (10). v3 is generally available (10). 20 + 20 + 15 + 10 + 10 + 10 = 85.

DocuSeal 90

Version 3.3.4 was tagged on 26 October 2026, seven days before the check, with its changelog entry dated the same day (30). Twelve tagged releases from 3.2.0 (11 August) to 3.3.4, one a week (20). GitHub shows 124 open issues and pull requests. Four of the five newest open issues have replies, and the pricing page says support usually answers within a few hours, per the 9 October check, not re-read on 2 November because GitHub's pages answer 403 in our session (18 of 25). Official SDKs are current, with the JavaScript client at 1.0.25 and the Python client at 1.0.9, both last changed on 24 August 2026 by their repositories, and the CLI last changed on 1 October (15). The repository has CI and Docker workflows (the CI workflow last changed on 23 October) and a spec folder. We did not read the current CI result (7 of 10). 30 + 20 + 18 + 15 + 7 = 90.

Youtrust 61

Read as a closed service. The changelog's newest entries are dated 21 October 2026 (30). Ten entries between 13 and 21 October 2026 (20). A help centre, contact@youtrust.com in the OpenAPI contact block, a changelog RSS feed and a feedback form for the AI connector. No public issue tracker (8 of 15). No official SDK; the GitHub organisation holds no client library and the docs point to generators and Postman (0 of 15). The OpenAPI file is current with the October changes and the MCP setup page was updated on 7 September 2026 (3 of 10). 30 + 20 + 8 + 0 + 3 = 61.

DocuSeal 52

One API key per user, sent in X-Auth-Token, stored as a SHA-256 hash and replaceable in the console, with separate keys for Test Mode. No scopes, expiry or read-only keys were found (18 of 30). User roles exist on the Pro plan and DELETE archives a record instead of erasing it, but there is no confirmation step before a send (6 of 20). Signer-entered values come back through the API. The agent skill carries security recommendations for embedding and tells clients to trust HMAC-verified webhooks over browser events, with nothing on treating signer text as untrusted (4 of 15). Each submission has an audit log file and an event list. No log of API calls was found (9 of 15). The security page claims SOC 2 Type II and ISO 27001 certification and a penetration test, and SECURITY.md gives a reporting address and states a bug bounty. No security.txt content and no published GitHub advisory. NVD lists one DocuSeal CVE, CVE-2024-52277 (December 2024, outside the 12 months), and OSV holds no record for the 3.0.0, 3.2.0 or 3.3.4 commits on 2 November. Release notes from 16 February to 28 September 2026 mention security fixes, improvements or hardening without naming a flaw (15 of 20). 18 + 6 + 4 + 9 + 15 = 52.

Youtrust 68

Bearer API keys with an Organization or Workspace scope and a Read-Only or Full-Access permission, separate per environment, created only by Admins and Owners, and OAuth for the AI connector with revocation in account settings. No expiry or rotation guidance found (26 of 30). Read-Only keys, workspace scoping, draft-then-activate, and the AI connector's examples ask before sending. The Developer MCP's execute-request runs any call with the key's full permissions, activation, cancellation and deletion included, and the API has no approval step (14 of 20). Signer names, field answers and documents return through the API, Safe String rules strip HTML, URLs and email addresses from inputs, and no injection guidance was found (4 of 15). Audit trails per signature request and signer, downloadable, plus consumption records; no log of API calls or key use was found (8 of 15). PGP-signed security.txt, a bug bounty and annual technical audits on the security page, eIDAS certification as a trust service provider, hosting in France. ISO 27001 was not named on the pages read (16 of 20). 26 + 14 + 4 + 8 + 16 = 68.

DocuSeal 55

Scored on the hosted cloud, which is the graded surface. No x402, MPP or L402 (0). A per-unit price is public, $0.20 for each document completed through the API or embedding, on top of at least one Pro seat at $20 a month (20). The Test Mode sandbox is free and unlimited and llms.txt says signup needs no card, but a production API key needs the paid Pro plan (15 of 20). A person has to sign up and copy the key from the console (0).

Youtrust 40

Read with the hosted rubric. No x402, MPP or L402 (0). API plan prices are public without login, Plus from €104 a month and Pro from €129 with €2 per extra signature (20). The sandbox trial lasts 40 days and needs no credit card per the API pricing page (20). A person signs up in a browser and an Admin creates the key there (0). 0 + 20 + 20 + 0 = 40.

DocuSeal 77

Public OpenAPI 3.1 file in YAML and JSON at console.docuseal.com with 23 operations and 11 webhook events, per the 9 October check, not re-read on 2 November (25). llms.txt and a Markdown twin of every page (10). Each operation has a summary and a description and each parameter is described, though none says when not to use a call (12). Request bodies are typed with required fields and 14 enums, with a free-form variables object (12). Each endpoint page carries request examples in ten languages and the file has 56 examples, but only 200 responses are documented and no error reference was found (8). A dated public changelog covers every release. The API has no version in its path and the file's version stays at 1.0.0 (10).

Youtrust 90

A public OpenAPI 3.0.0 file with 178 operations on 114 paths, a bearer scheme and 282 enums (25). developers.youtrust.com serves llms.txt, a per-section llms.txt and a Markdown twin of every page (10). Every operation has a description, 28 of them under 40 characters, and the guides explain the signature request lifecycle, when to use templates and the Tolerant Reader rule (14 of 20). Required fields, 282 enums, a Safe String type with stated rules, and a free-form metadata object (13 of 15). 1,307 examples in the file, every operation documents 400, 401, 403, 404, 405, 429 and 500, the error page gives the type, detail and invalid_params shape with retry guidance per code, and a list of error types is published (15). v3 in the path, a versioning page with compatibility rules, a Deprecated tag in the file, and a changelog with ten entries dated 13 to 21 October 2026 and an RSS feed, with no removal timeline (13 of 15). 25 + 10 + 14 + 13 + 15 + 13 = 90.

DocuSeal 80

The core is AGPL-3.0 with an added attribution term, and the Pro functions, which include creating templates and submissions from PDF, DOCX and HTML, are closed and sold under a paid licence (24 of 30). The privacy policy of 6 October 2026 and the GDPR page agree on US and EU hosting and on eight sub-processors. Retention is stated only as as long as necessary, and a DPA is signed on request and not published (22 of 30). No deprecation policy was found. The changelog flagged three breaking changes to embedded forms in the 2.5.0 note of 20 April 2026, on the day of release (6 of 20). Sub-processors are listed with locations, AWS in the US and Ireland among them (18 of 20).

Youtrust 72

Closed service under Terms of Use and Subscription updated 2 July 2026 that name Youtrust SAS under French law, with the previous version linked. The OpenAPI file's licence reads proprietary (15 of 30). The privacy policy names Youtrust SAS of Caen, lists retention periods by purpose (the contract term plus five years in France and ten in Germany and Italy for some records), links a list of subprocessors, and the security page says hosting is exclusively in France with evidence files archived at Arkhinéo (22 of 30). The versioning page says deprecated endpoints and properties keep working and are not planned for removal, compatible changes arrive without notice, and the terms describe an end-of-life notice for old platform versions with no period (10 of 20). A subprocessor list is linked from the privacy policy, hosting is in France at AWS EMEA's French branch per the legal notice, and no notice period for new subprocessors was found (17 of 20). 15 + 22 + 10 + 17 = 64.