inSign Review (2026): Biometric AES Signing, Made in Germany

Draw your signature with a finger on a phone and most tools log it as a simple electronic signature: a picture of a scribble.

inSign treats the same gesture as an Advanced Electronic Signature under eIDAS, because it captures the biometric dynamics of how you sign (movement, speed, pressure) and seals them into the evidence trail. That single decision is why a fifteen-year-old German product still stands out.

inSign is made by inSign GmbH in Marzling, Bavaria, just north of Munich. BSI Business Systems Integration Deutschland has owned it since 2022, though inSign GmbH develops and operates the product independently.

The positioning is unambiguous: "Made and hosted in Germany." No US cloud, EU data residency, and a compliance stack built for German and European regulated industries. More than 10 million users across Europe have signed with it, and it holds a 4.8 rating on Capterra.

What inSign is (and isn't)

inSign is an assurance-first signing platform rather than a document-automation suite.

Its cleverest idea is offering the full eIDAS ladder inside one document. Type your name for a Simple Electronic Signature, add an SMS code to step up to AES, draw your signature for a biometric AES, or use a certificate for a Qualified Electronic Signature. You can mix methods in the same document, matching the assurance level to each signer and each clause.

There is no PandaDoc-style proposal building or dynamic pricing here. The authoring flow is deliberately narrow: upload or photograph a paper document, drag on signature, text, checkbox and photo fields, then send.

The distinctive part is the weblink model, a reusable public signing link where the signer needs no account and no login. For front-desk or web-form scenarios that is a materially different workflow from the usual one-recipient envelope.

Who it's for

inSign fits German-speaking and European regulated sectors where a handwritten-style signature still carries weight and data has to stay in the EU: insurance, finance, healthcare, energy, tax advice, real estate and public administration. Debeka, Die Mobiliar, HDI, Thüga Energienetze and V-BANK are among its reference customers, a list that skews heavily toward insurers, banks and utilities that get audited.

If your signing is US-centric and volume-driven, a generalist like DocuSign covers more ground.

Cross-border Swiss work is not a reason to look past inSign, since it supports both eIDAS and ZertES and its signatures hold on either side of the border. Skribble is still the sharper pick if you want to choose the jurisdiction per signature and keep data in Switzerland.

But if your requirement reads "biometric AES out of the box, made and hosted in Germany, GDPR without a US-cloud dependency", inSign is one of the most complete answers in the category.

inSign publishes a clear per-user price for its standalone product and quotes API and enterprise editions on request. Every plan includes a free trial with no credit card.

One number is missing from the price list, and it matters: qualified signatures cost extra. Typed and handwritten signing are covered by the plan, but QES is billed on top, per signature, at a rate inSign does not publish. At any real qualified volume that unlisted figure, not the €24.90 headline, decides whether inSign is cheap or expensive.

• inSign 365: €24.90 per user/month (annual, plus VAT). The standalone web app with the full signing feature set. Billed monthly it is €26.90; the annual term runs 12 months, and a volume discount applies from two users up, so the per-user price falls as the licence count rises.
• inSign connect (API): price on request. The SaaS interface for embedding inSign into your own software, portals and business systems, including the SAP and Salesforce connectors.
• inSign enterprise: price on request. Licensing for extensive, unlimited requirements, with the on-premises, multi-tenant and single sign-on options.

A separate product, inSign Siegel, adds an eIDAS electronic company seal for proof of origin and tamper-proofing for documents such as mass invoices, applied via the REST API and SAP. Pricing may change; check the official website for the most current numbers.

Security is inSign's home turf. Everything runs on EU-based servers with, in the vendor's words, "100% data sovereignty and no US-cloud dependency".

The compliance evidence is unusually deep for a mid-market product: ISO 27001 at full scope, C5 according to the German Federal Office for Information Security, a §203 StGB professional-confidentiality declaration, and full GDPR compliance.

The cryptography is specific rather than hand-wavy: asymmetric RSA-3072 with NIST P-384 elliptic-curve keys and AES-256-class symmetric encryption.

Biometric signature data, the handwriting dynamics behind an AES, is asymmetrically encrypted, with the private key typically generated and deposited at an independent authority such as a notary, so no single party can reconstruct it alone.

Two-factor authentication is available, and every session produces an audit report logging date and time, the trigger and action including device, the signature event, the biometric-consent confirmation and the named field. Once a document carries its first signature it can no longer be changed.

Integrations

inSign is built to sit inside existing business software rather than replace it. There is a Microsoft Office and Outlook add-in, connectors for SAP and Salesforce, and BSI's own CRM.

Larger deployments use the REST API to embed signing into portals and line-of-business systems. It is the same API behind automated bulk sealing with inSign Siegel, where invoices are sealed and then processed straight through in SAP. Native iOS and Android apps cover mobile signing, and recipients sign in any current browser with nothing to install.