The short answer: compliance with GDPR and HIPAA depends on how and where your signing data is stored. OpenSign™ is open source and self-hostable, so you can keep signed documents and audit logs entirely within your own controlled environment — a strong foundation for GDPR, HIPAA and data-residency requirements.
How OpenSign supports compliance
- Self-hosting — keep all personal and health data on your own servers.
- Data residency — store documents in a specific region or private network.
- Encryption — protect documents in transit and at rest.
- Audit trail — a timestamped record of every action for accountability.
- Access control & SSO — restrict who can send and view documents.
- Open source — auditable code for your security and compliance reviews.
GDPR considerations
GDPR emphasizes lawful processing, data minimization and control over personal data. Self-hosting OpenSign lets you decide exactly where EU personal data lives and how long it's retained, supporting your data-protection obligations.
HIPAA considerations
For organizations handling protected health information (PHI), self-hosting keeps signed forms and PHI within your secured systems rather than a third-party cloud. Combine encryption, access controls and your own policies to support a HIPAA-aligned workflow.
This page is informational, not legal advice. Confirm your specific obligations with your compliance team.
Get started
Deploy OpenSign on your own infrastructure following the self-hosting guide, or review the project on GitHub.
Ready to try it? Create a free OpenSign account and start signing documents in minutes — no credit card required. Prefer to run it yourself? OpenSign is 100% open source on GitHub.