How to Choose E-Signature Software in India: A Scorecard You Can Run Yourself
Most "best eSign software in India" lists are written by a vendor that ranks itself first. This guide gives you a weighted scorecard built on what Indian law and your own risk actually require, so you can rank vendors yourself.
Every "best eSign software in India" article has the same flaw: the author sells one of the products. This guide does not rank anyone. It gives you the criteria that matter under Indian law and in Indian operations, a weighting you can adjust, and the questions that expose the gaps a demo will not show. Position as of October 2026.
The nine criteria
1. Statutory signature methods (weight 20). Which Second Schedule methods are supported: Digital Signature Certificates under section 3 of the IT Act, 2000 and Aadhaar eSign under section 3A (OTP and biometric). Only these satisfy a statutory signature requirement under section 5. A platform that offers only click-to-sign is a document-acceptance tool, not an e-signature provider for Indian purposes. Check that the eSign Service Provider and Certifying Authority the vendor uses are on the Controller of Certifying Authorities' current lists.
2. Evidence and audit trail (weight 15). The record must let you prove the signature under section 63 of the Bharatiya Sakshya Adhiniyam, 2023: document hash, identity events, timestamps with a reliable time source, IP and device data, dispatch and view history, and the ability to issue a section 63(4) certificate years later. Ask for a sample certificate and a sample audit trail for a document signed with each method.
3. E-stamping (weight 10). Stamp duty is payable before or at execution (section 17, Indian Stamp Act, 1899), and an unstamped instrument is inadmissible until duty and penalty are paid (section 35). Check which states' e-stamping systems the vendor integrates with, whether the stamp certificate is attached automatically, and how the vendor handles states it does not cover.
4. Excluded-document controls (weight 5). The First Schedule still excludes most negotiable instruments, most powers of attorney, trusts and wills. A good system lets you mark templates as not eligible for e-signature.
5. Data protection and residency (weight 15). The vendor is your Data Processor under section 8(2) of the DPDP Act, 2023; it must sign a processing contract with security provisions (rule 6, DPDP Rules, 2025) and support your 72-hour breach report to the Data Protection Board (rule 7, from 13 May 2027). Regulated entities need storage in India where RBI's 2025 outsourcing Directions require it. Ask: where is data hosted, is an Indian region available, what are the breach-notification timelines in the contract, and does the vendor fall within CERT-In's 2022 Directions (6-hour incident reporting, 180-day logs in India).
6. Security certifications and controls (weight 10). ISO 27001 or SOC 2 reports (ask to see them, not the badge), MFA and role-based access for your admins, encryption at rest and in transit, and a vulnerability-management process.
7. Workflow fit (weight 10). Templates, fields, sequential and parallel signing, bulk sending, reminders, recipient management, dispatch tracking, and APIs or connectors for your CRM, HRMS or ERP. Score against your top three use cases, not the feature list.
8. Commercial terms (weight 10). Pricing unit (per user, per envelope, per Aadhaar or DSC transaction), what counts as a user, annual escalation, GST treatment, and exit: can you export every document with its audit trail in a usable format.
9. Vendor standing (weight 5). Years in operation, Indian presence, customer references in your sector, and support hours.
The scorecard
| Criterion | Weight | Vendor A | Vendor B | Vendor C |
|---|---|---|---|---|
| Statutory signature methods | 20 | |||
| Evidence and audit trail | 15 | |||
| E-stamping coverage | 10 | |||
| Excluded-document controls | 5 | |||
| Data protection and residency | 15 | |||
| Security controls | 10 | |||
| Workflow fit | 10 | |||
| Commercial terms | 10 | |||
| Vendor standing | 5 | |||
| Total | 100 |
Score each criterion 0 to 5, multiply by weight, divide by 5. Change the weights to suit you: a lender should raise the signature-method and residency weights; a design agency signing NDAs can lower them.
Ten questions that separate vendors
- Which licensed ESP and CA do you use for Aadhaar eSign, and can you show the CCA listing?
- Show me a section 63 certificate for a document signed three years ago.
- Which state e-stamping systems do you integrate with, and what happens for the rest?
- Can a template be blocked from e-signature because it is a First Schedule document?
- Where is our data stored, and can we choose India only?
- What breach-notification timeline will you sign up to in the processing agreement?
- Are you within CERT-In's 2022 Directions, and how do you meet the 6-hour reporting rule?
- Show me your ISO 27001 certificate or SOC 2 report, not the logo.
- What is a "user", and how are Aadhaar and DSC transactions billed?
- Walk me through the exit: what do we get, in what format, how fast?
Where Legatio fits. Legatio is one of the vendors you should run through this scorecard, and we will answer all ten questions in writing. The criteria come from Indian law and operations, not from our feature list.
Position stated as of October 2026. General information, not legal advice.