Add document signing to your SaaS
Workflow architecture, signer experience, trust layer and build-vs-integrate decisions for embedding PDF signing in your application.
Published Sep 9, 2026 · Updated Oct 3, 2026 · 3 min read
Example project: an HR portal
Before we talk: prepare a fictitious PDF, participant roles, signing order rules, volumes, authentication method and desired storage location.
Embedding electronic signing in a SaaS product is more than a « Sign » button. You orchestrate documents, identities, field placement, authentication, tracking and evidence — then connect production trust infrastructure that matches each customer’s context.
Why a dedicated workflow
Product teams rarely want to rebuild signer UX, multi-signer orchestration and PAdES output from scratch. A workflow foundation lets you validate UX, statuses and deliverables (signed PDF, evidence report) before wiring certificates, HSMs or the customer’s trust provider.
System layers
| Layer | Role | Examples |
|---|---|---|
| Your application | Business journey, branding, permissions | CRM, HR, customer onboarding |
| Khatm workflow | PDF orchestration, signers, fields, tracking | Invite, placement, finalize |
| Identity | Who signs, authentication | Magic link, passkey, enterprise IdP (project-specific) |
| Trust | Certificate, timestamp, sealing | Customer PKI, local TSP, HSM |
Typical journey
- Create or import the PDF from your application.
- Define signers and fields (signature, date, text).
- Authenticate the signer at signing time.
- Apply PAdES signing and timestamp when configured.
- Track status and deliver final PDF plus evidence.
Trust layer
In production, evidential weight depends on certificate, identification and applicable framework. Khatm can be adapted to use infrastructure chosen with the customer — enterprise certificates, local trust service, qualified device — based on regulatory analysis and architecture.
Build or integrate
- Build from scratch: slow, expensive, UX and technical compliance risk.
- Integrate an existing workflow: faster time-to-market, focus on product and trust wiring.
- Khatm: self-serve API v1 sandbox (test keys, signed webhooks) to integrate and test, then implementation support to adapt the flow and connect the trust layer in production.
General information, not legal advice. Confirm the requirements for your transaction with the appropriate adviser or receiving authority.
Does Khatm offer a public API?
Yes. The REST API v1 is documented and self-serve in the sandbox: create an account, generate a test key and send your first signature requests. Production is then prepared with Khatm (identity, certificate, retention).
Is the sandbox enough for production?
No. It validates the workflow. Production requires appropriate identity and trust infrastructure for the project.
Is PAdES supported?
Yes technically in the flow (PDF signing, timestamp when configured). The certificate determines external recognition.