A Contract That Took 12.4 Days, and a Seal Riding in the VP's Car
A 180-person equipment distributor measured its first half of 2026: a purchase contract took an average of 12.4 days from initiation to both parties applying their seals, and 9 of those days were spent waiting for someone to be back at their desk. Courier costs ran NT$180 per document, or NT$250,000 across 1,400 documents a year. Worse, of 30 contracts sampled in the annual audit, 6 could not prove who gave final approval. What they needed was a system that proves who signed which version, when, and under what verified identity.
This is process and technical planning guidance, not legal advice. Consult a lawyer for important documents.
When It Fits vs. When It Does Not
| ✅ Good fit | ❌ Not advised, or verify first |
|---|---|
| 200+ documents per month, 3+ approval steps | Under 30 documents a month, single approver |
| Initiated automatically from ERP or CRM | Real property rights, wills, family-status documents |
| Signers include external clients or suppliers | Statute requires writing or notarisation |
| Audit requires traceable signing evidence | Counterparty insists on an original red seal |
Taiwan's Electronic Signatures Act took effect in its full 22-article form in May 2024, the first major overhaul since 2002: electronic documents and signatures are functionally equivalent to physical ones and may not be denied legal effect merely because they are electronic, and competent-authority status moves to the Ministry of Digital Affairs. Where other statutes impose a writing requirement, those rules still govern.
Alternatives Matrix
| Option | Strengths | Limits | Cost band |
|---|---|---|---|
| DocuSign eSignature | Globally recognised, thorough compliance docs | Metered by envelope, overage purchases | Standard about US$25/user/month (annual, 100 envelopes/year) |
| Adobe Acrobat Sign | Seamless with PDF workflows | Advanced authentication billed separately, enterprise negotiated | Priced under Acrobat business plans |
| Taiwan-local SaaS (DottedSign) | Traditional Chinese UI, local support | Limited flexibility for complex routing | Pro tier from about US$9.99/user/month |
| Custom Laravel platform | Embeds into the ERP, marginal cost near zero | High upfront investment, compliance is yours | From NT$260,000 plus variable fees |
Full Process Breakdown
| Stage | Duration | Deliverables | Tools |
|---|---|---|---|
| 1 Document inventory and tiering | 5 days | Digitisable-document list, verification-strength map | Notion, legal interviews |
| 2 Signing route modelling | 4 days | Five signing route diagrams | Miro |
| 3 Signing experience design | 5 days | Four operating screens | Figma |
| 4 Workflow engine development | 12 days | State machine, reminders, single-use tokens | Laravel Queue |
| 5 Verification and evidence | 10 days | OTP, certificate integration, SHA-256, timestamps | MOICA citizen certificate, MOEACA business certificate, RFC 3161 TSA |
| 6 Audit trail and packaging | 7 days | Hash chain, PDF/A package and report | setasign FPDI |
| 7 Load testing and go-live | 5 days | Replay report, training, operations manual | k6, UptimeRobot |
That totals 48 working days, roughly 10–11 weeks. Verification runs in four tiers:
- L1 named link: internal leave and expense forms
- L2 email or SMS OTP: NDAs, quotes, general contracts
- L3 OTP plus ID review: first-time counterparties
- L4 citizen or business certificate signature: high-value contracts, government filings
The audit trail needs at least 14 fields; the key eight are: document SHA-256, verification method and evidence reference, IP, user agent, event type (viewed / signed / declined / voided), UTC time with original timezone, timestamp token, and previous event hash — that last one chains the events, so any after-the-fact edit breaks the chain.
Full Cost Breakdown
- ScriptWalker "E-Signature and Approval System Build": from NT$260,000 (workflow engine, tiered verification, audit trail, packaging)
- Certificate integration module +NT$90,000–150,000; ERP integration from +NT$60,000
Hidden costs (at 1,000 documents per month):
- SMS OTP at NT$0.8–1.2 per message, 2 per document, about NT$2,000/month
- Qualified timestamps at NT$1–5 each, about NT$1,000–5,000/month
- Card readers and components: NT$600–1,200 per site (L4 only)
- Archival: audit PDFs average 2 MB, about NT$400/month for 7-year retention
- Sending-domain reputation upkeep (DMARC) about NT$1,500/month
- Annual maintenance at 15–20% of build cost, i.e. NT$39,000–52,000/year
Break-even sits around 120 seats or 500 documents a month: SaaS licensing already exceeds NT$900,000 a year, while a custom build costs roughly NT$320,000–380,000 in year one.
Implementation Reality vs. Client Expectations
| Clients assume | What actually happens |
|---|---|
| It is just drawing a signature image | The signature image is under 5% of the effort; legal weight comes from verification and the evidence chain |
| We go fully paperless at launch | Typically only 60–70% of documents convert in year one; the rest need case-by-case review |
| Approval is one straight line | Inventory usually reveals 5–8 routes: counter-signing, delegation, value tiers, send-backs |
| We can add the audit trail later | The hash chain must start at event one; retrofitting produces no evidentiary value |
Common Pitfalls and How to Avoid Them
- Using an editable PDF as the final file: it stays changeable. → Flatten and lock on completion, compute SHA-256 and write it into the chain.
- Link only, no second factor: a compromised or forwarded mailbox means a forged signature. → Apply L2–L4 tiering by value; single-use tokens with 7-day expiry.
- Using the server's local clock: one timezone change destroys credibility. → Use RFC 3161 timestamps and store UTC.
- Audit trail living only in the operational database: if a DBA can edit it, it is not evidence. → Hash chain plus daily archival to write-once storage.
- No declined or voided states: mistakes force delete-and-redo. → Define declined and voided; never hard-delete evidence.
Success Metrics and the 90-Day Roadmap
- Day 30 — throughput: Is the completion rate 90% or higher? Has average signing time dropped from 12.4 days to under one day? Focus on OTP failure rates and the signature pad.
- Day 60 — adoption: Is document coverage at 70% or higher? Is the send-back rate under 8%? Usually a counter-sign stage modelled too granularly.
- Day 90 — auditability: Sample 20 documents and replay verification; hashes and timestamps must pass 100%. Drop low-risk documents to L2 and save another 30–40% per document.
Decision Checklist
- ☐ Do you sign more than 200 documents a month?
- ☐ How many approval steps on average, and at most?
- ☐ Do you need counter-signing or delegated signing?
- ☐ Do signers include external suppliers?
- ☐ Has legal confirmed what can be digitised?
- ☐ Which documents require certificate-grade verification?
- ☐ Should the ERP initiate documents automatically?
- ☐ How many years must audit retain the records?
- ☐ Must signed documents still verify in 5 years?
- ☐ Who approves send-backs and voids?
- ☐ Who owns templates and routing rules?
- ☐ Have you costed the paper process annually?
Eight checks make a custom build worthwhile; three or fewer, start with SaaS.
Frequently Asked Questions
Are e-signed contracts valid in Taiwan?
Under the Electronic Signatures Act effective May 2024, electronic documents and signatures are functionally equivalent to physical ones and may not be denied legal effect merely because they are electronic. Where a statute still requires writing, those rules govern — confirm with a lawyer.
Do we have to use a citizen certificate?
Not necessarily. Certificates are digital signatures with the strongest evidentiary weight, suited to high-value or government documents; general contracts do fine on SMS OTP with a full audit trail and timestamps.
Can counterparties sign without an account?
Yes. External signers use a single-use link plus OTP with no registration; the system still records IP, device and time. Forcing registration typically drops completion by 20%.
Will it still verify after 5 years?
Only if you plan for it. Certificates expire, so embed PAdES-LTV validation data at packaging time, renew timestamps periodically, and keep the hash chain in write-once storage.
Next Steps
ScriptWalker offers a free 30-minute signing-workflow diagnostic: bring your three most time-consuming document types and their approval steps, and we return an assessment and budget covering what can be digitised, which verification tier applies, and whether to build or buy. The "E-Signature and Approval System Build" starts at NT$260,000 and includes inventory, route modelling, tiered verification, and timestamp evidence retention, delivered in 10–11 weeks.
- Email: [email protected]
- Phone: 0916-224-047
- LINE: @ufv9089p