If you're building a Canadian SaaS product, a clinic portal, or an internal tool that needs signatures, at some point you have to pick an e-signature API. The keyword search usually starts the same way: e-signature api canada. What people actually need is a clear answer on where data is processed, how proof works, and how fast they can ship an integration.
Where envelope data actually lives
VG·Sign stores and processes envelope content, the database, file storage, and app servers, in the Montreal region. The database and storage run on Supabase hosted on AWS ca-central-1, and the application servers run on Vercel's yul1 region.
That said, a couple of providers in the pipeline are US-based: email and SMS delivery, and payment processing. When a signing process completes, the completion email attaches the signed PDFs, so that specific step is a cross-border hop. If your compliance review needs exact infrastructure details, this is the level of specificity to ask any vendor for, not just us.
What the API needs to do well
A signature API for a Canadian business has a short list of real requirements. It needs to create envelopes programmatically, track status changes without polling everything, and hand back a verifiable final document.
- Create and send envelopes from your own app, with templates and dynamic fields.
- Receive webhook events for sent, viewed, signed, declined, and completed states.
- Pull signed PDFs and audit trail data back into your system of record.
- Support multiple signers with defined signing order where the workflow requires it.
Proof of integrity, concretely
Once a document is fully signed, VG·Sign generates a SHA-256 hash of the final PDF. That hash, together with an append-only audit log of every action taken on the envelope, is what you rely on to show the document hasn't been altered after completion.
This is not a blockchain-style hash chain, and we don't describe it as one. It's a cryptographic fingerprint of the finished file plus a log that cannot be edited after the fact. For most contract and HR use cases, that combination is the practical bar, and it's easy to explain to an auditor or a client's legal team.
What this means for your integration
When your webhook receives a completed event, store the hash alongside the document reference in your own database. If you ever need to confirm a PDF hasn't been modified, recompute the hash and compare. That's a five-minute check, not a support ticket.
A typical integration flow
- Authenticate your app and create an envelope with the document and signer fields.
- Send the envelope and store the returned envelope ID in your own records.
- Listen for webhook events to update your UI as signers view and sign.
- On completion, fetch the signed PDF and the SHA-256 hash, store both.
- Optionally pull the audit log for your own compliance archive.
None of this requires you to build a signing UI from scratch. Signers interact with a hosted signing page, and your app only needs to manage the envelope lifecycle through the API and webhooks.
Where this fits against legal context
Canadian businesses often ask whether an e-signature is legally valid here. In general terms, Canada's electronic signature framework (including Ontario's Electronic Commerce Act, PIPEDA for personal information handling, and the Uniform Electronic Commerce Act adopted across most provinces) supports electronic signatures for most commercial contracts. This is general background, not legal advice, and you should confirm requirements for your specific document type and province with your own counsel.
If you're scoping a project and need to know what's included at each tier, See current plans and limits
Teams migrating off a larger platform often start with our DocuSign alternative comparison
Picking the right starting point
If you're early in evaluation, start with a small integration: one document type, one webhook handler, and a manual check of the hash and audit log on a handful of test envelopes. That gives you a working sense of the API's shape before you commit to a full rollout.
For more integration patterns and product updates, the
VG·Sign blog covers specific workflows as they're added.
Frequently asked questions
- Does VG·Sign offer a REST API for e-signatures in Canada?
- Yes. You can create envelopes, send documents for signature, and receive webhook events for status changes, all while envelope content is processed through infrastructure in the Montreal region.
- Is any part of the data flow outside Canada?
- Yes, specifically email and SMS delivery and payment processing run through US-based providers, and the completion email that attaches signed PDFs is a cross-border step. Database, file storage, and app servers run in Montreal.
- How does VG·Sign prove a signed document hasn't been changed?
- VG·Sign generates a SHA-256 hash of the final signed PDF and keeps an append-only audit log of every action on the envelope. You can recompute the hash at any time to confirm the file matches the original.
- Is VG·Sign SOC 2 or ISO 27001 certified?
- No. VG·Sign does not currently hold SOC 2, ISO 27001, HIPAA, or eIDAS certifications. If your procurement process requires a specific certification, confirm that requirement against our current status before committing.
This article is for general information only and is not legal advice. For advice on your specific situation, consult a qualified professional.