How to Build an Online Contract Signing System: From Taiwan's Electronic Signatures Act to Certificate Integration

A Distribution Contract Takes Three Days, Two of Them Spent Waiting on a Courier

A 40-person equipment distributor signs roughly 60 quotation confirmations and distribution agreements a month. The routine: sales emails a PDF, the client prints it, applies the company chop, scans it back, and admin files it. Average round trip is 2.8 days, of which under 20 minutes is spent actually reading the terms. The rest is logistics and hunting down whoever holds the seal. Courier fees and paper archiving alone run about NT$140,000 a year, before counting the deals that stall while sales waits. Taiwan's Electronic Signatures Act was amended in 2024 for the first time since it took effect in 2002, and that gives this problem a solid legal floor to build on.

Who Should Build This, and Who Should Wait

Good fit

Steady volume above 20 signed documents a month, with highly repetitive templates: quotes, renewals, NDAs, employment contracts, reseller authorizations.
Counterparties spread across cities or countries, where shipping time is itself the cost.
Multi-party or sequential internal approval, such as sales manager then finance then legal.
An audit requirement: who signed, when, from which IP, provable years later.

Wait, for now

Under 10 signatures a month. Buying seats beats building anything.
Documents inside judicial proceedings, including civil, family, criminal and administrative litigation, which the amended act explicitly excludes.
Bank loan verification, real estate registration, and certain regulatory filings that still demand paper or a designated channel.
Contracts where every clause is bespoke and cannot be turned into fields. You would just be typing manually somewhere new.

Four Approaches and What They Really Cost

Approach	Strength	Limit	Annual cost band
Pure SaaS (DocuSign, DottedSign)	Usable same day, mature UI, works across borders	Workflow locked to the vendor, data offshore, cannot embed in your back office	NT$4,000–120,000
SaaS API embedded in your system	Client signs inside your site, results write back to CRM	Per-envelope billing scales with volume; vendor outage stops you	NT$60,000–300,000 plus build
Self-built signing engine	Full control of flow, templates and audit trail; lowest unit cost long term	High upfront spend, you own compliance and security	Build plus NT$30,000–80,000 upkeep
Keep scanning paper	Zero setup cost	No audit trail, easy to alter, filing depends on a person	Courier plus labor, routinely underestimated

Reference points: DocuSign eSignature Standard runs about US$25 per user per month on annual billing with a 100-envelope yearly allowance, while DottedSign moved its Business plan to per-task pricing in 2025 at US$1.70 per task, roughly US$340 for 200 tasks. Once you cross a few thousand documents a year, amortized in-house build starts winning.

Four Phases From Requirements to Launch

Phase 1: Document inventory and risk tiering (5–8 working days). List every document the company signs and sort it into high, medium and low tiers by contract value and dispute exposure. High tier goes to certificate-backed digital signature; medium and low ride ordinary electronic signature plus SMS OTP. Deliverables: document register, risk tier table, signing authority matrix. Tools: Notion, Google Sheets.
Phase 2: Template fielding and flow design (8–12 days). Turn every blank on the PDF into a bound field such as tax ID, signing date, amount, then design approval order and rejection paths. Deliverables: Figma flow, template field map. Tools: Figma, pdf-lib or Apache PDFBox.
Phase 3: Signing engine and audit trail build (20–35 days). Implement identity verification (email link plus SMS OTP, certificate on top for high tier), document hashing, PAdES-format signatures, RFC 3161 timestamps, and a complete event log. Deliverables: working system, audit report export, public verification page. Tools: Laravel or Next.js, AWS S3 or Cloudflare R2, a TWCA timestamp service.
Phase 4: Pilot signing, legal review, launch (10–15 days). Run 30 real signatures on one or two document types, have counsel review the consent-to-electronic-form clause and the evidence retention design, then open it up. Deliverables: acceptance checklist, staff training, Sentry and UptimeRobot monitoring.

Real Cost: Three Budget Tiers and the Hidden Line Items

Entry, NT$120,000–180,000. Integrate an existing SaaS API, embed the signing page in your site or back office, write results back to CRM via webhook, no certificate work.
Mid, NT$350,000–600,000. Self-built signing engine with template fielding, multi-party approval, reject-and-resign, full audit trail and PAdES long-term retention.
Advanced, NT$900,000–1,500,000. Adds certificate-based digital signature using MOEA business certificates or MOI citizen digital certificates, timestamping, two-way ERP sync, layered permissions and exportable audit reports.

Costs clients forget

A business certificate costs NT$420 per card with a five-year validity, payable again if lost or reissued, plus a card reader at NT$300–600, per the MOEA Certificate Authority.
Qualified timestamp (TSA) service: NT$15,000–40,000 a year.
SMS OTP at NT$0.7–1.2 per message; 300 signings a month lands around NT$500–800.
Long-term document storage on standard plus archive tiers: NT$300–1,500 a month.
Legal review of consent clauses and evidence flow: NT$20,000–50,000.
Annual maintenance at 15–20 percent of build cost.

What Clients Expect vs What Happens

Expected: paper disappears on launch day. Actual: bank verification, property registration and some filings stay on paper; most companies land at 60–75 percent electronic in year one.
Expected: the signature feature is the hard part. Actual: more than half the hours go to fielding templates and untangling approval order. Signature capture itself takes about two weeks.
Expected: a famous platform guarantees legality. Actual: enforceability comes from technology that identifies the signer and detects tampering, plus the counterparty's consent to electronic form. The platform is a vehicle, not a verdict.
Expected: store the signed PDF and you are done. Actual: without long-term validation, the signature becomes unverifiable once the certificate expires, often within three years.

Six Traps and How to Dodge Them

Pasting a signature image onto a PDF and calling it an electronic signature. Fix: you need all three of identity verification, document hashing and an event trail. Missing any one makes a dispute painful to argue.
Never giving the counterparty a chance to object to electronic form. Fix: the amended Article 5, paragraph 4 requires reasonable notice and an opportunity to object before adopting electronic form, with consent presumed absent objection. Build it into the signing page as a logged, required checkbox.
One verification level for every document. Fix: tier it. A multi-million-dollar distribution right deserves a certificate-based digital signature; an NDA is fine with OTP. Over-heavy verification makes counterparties abandon the flow.
Audit trails that record only a timestamp. Fix: log signer email and phone, IP, user agent, OTP result and a hash of every document version, and make the report downloadable.
Templates hard-coded into the application. Fix: put field configuration in the admin panel. Legal changing one sentence should not open an engineering ticket.
No verification landing page. Fix: publish a page where anyone can enter a document ID and confirm the hash and timestamp. It changes how counterparties feel about signing.

Success Metrics and a 90-Day Roadmap

Day 30: adoption and completion. Target 70 percent electronic on the two chosen document types and average turnaround down from 2.8 days to under 8 hours. Log every reason someone reverted to paper.
Day 60: bottlenecks. Measure dwell time at each signing stage to find the slow signer. Tightening the overdue reminder from 72 to 24 hours typically adds another 10–15 percent completion.
Day 90: expansion and unit cost. Grow from 2 document types to 6–8, compute true cost per signed document (SaaS usage plus SMS plus storage), and decide whether to move from API mode to self-hosted. Run a verification drill to confirm documents signed a year ago still validate.

Decision Checklist

☐ Do you sign more than 20 documents a month?
☐ Do you have three or more highly repetitive templates?
☐ Can you state your current average turnaround in days?
☐ Do any documents need two or more sequential approvers?
☐ Have you ever lost money to a wrong contract version?
☐ Have you tiered documents by value and risk?
☐ Do high-risk documents need certificate-grade digital signatures?
☐ Has the company obtained a business certificate?
☐ Do signing results need to write back to CRM or ERP?
☐ Will compliance or audit ever inspect the trail?
☐ Must documents be retained beyond five years?
☐ Is someone accountable for maintaining templates?
☐ Are you comfortable storing signing data offshore?

Eight or more checked and the return on an API integration or self-build usually holds. Under five, buy a SaaS seat and run it for three months first.

Frequently Asked Questions

What is the difference between an electronic signature and a digital signature in Taiwan?

A digital signature is one type of electronic signature. Per the Ministry of Digital Affairs briefing on the amendment, a digital signature made with a certificate issued by a government-licensed certification authority is presumed to be the signer's own signature or seal. An ordinary electronic signature leaves the burden of proof with you in a dispute. Both the MOI citizen digital certificate and the MOEA business certificate come from licensed authorities.

Is a contract signed with DocuSign or Adobe Acrobat Sign valid in Taiwan?

In December 2022 the Ministry of Digital Affairs issued an interpretation listing the technologies that carry electronic-signature effect, citing PKI architecture and signature formats and algorithms set by ETSI, NIST and ISO. A platform using those technologies, with the parties' consent, produces a valid electronic signature. In practice, also check whether the platform's certificate sits on the Adobe Approved Trust List, which makes verification far smoother.

How long does a self-built system take, and can we start smaller?

You can, and you should. Pick one document type, usually the quotation confirmation, and ship an MVP with template fielding, OTP verification and an audit trail in 6–8 weeks for roughly NT$150,000–250,000. Expand after 30 real signings. That is far safer than launching eight document types at once.

How long should signed documents be kept, and what happens when the certificate expires?

Depending on contract type and tax requirements, 5 to 10 years is the common range for commercial agreements. To keep a signature verifiable after certificate expiry, attach a qualified timestamp and embed validation data at signing time, the PAdES-LTA approach. Skip it and in a few years you hold a PDF nobody can validate.

Next Step

ScriptWalker's e-signature and contract workflow build starts at NT$120,000 and includes the document inventory, the risk tier table and one signable MVP. If you have a stack of contracts cycling through the same loop every month, send us the list. We will return a free feasibility read showing which document types to digitize first and how many days you would get back.