In the North American E-Signature Market, SaaS Offerings Are Increasingly in Demand

Research Publication Date: 18 August 2011 ID Number: G00215378 In the North American E-Signature Market, SaaS Offerings Are Increasingly in Demand Gregg Kreizman Enterprises are becoming increasing comfortable with e-signature capabilities delivered by software as a service (SaaS), and these services are alluring to IT and line-ofbusiness owners who foresee rapid implementation and ease of use, particularly for single lines of business. We expose this trend and increased demands for mobile platforms for signing, highlight SaaS functional capabilities, put to bed the legal issue of using these services, identify the vendors, and provide a framework for deciding to use SaaS or on-premises e-signature software. Key Findings Gartner's client buying patterns show a clear trend toward the use of SaaS based e- signature services instead of on-premises software. On-premises offerings still have their place for organizations that need to support multiple business processes and have complex workflow and integration requirements. On-premises solutions are also favored by organizations that do not want a third party involved with sensitive document signing. Customer mobility requirements are pushing SaaS vendors to deliver new features for phones and tablets to maintain a compelling case for SaaS e-signature adoption. Recommendations Take inventory of potential e-signature needs across systems and business processes, and size transaction volumes across business units to help plan for and reduce e- signature service costs through appropriate volume purchases. Create a software abstraction layer when interfacing on-premises systems with SaaS e- signature services to minimize changes needed to applications when changing vendors. Consider smaller vendors, particularly for ad hoc, simple contract or agreement signing to save costs. 2011 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. This publication may not be reproduced or distributed in any form without Gartner's prior written permission. The information contained in this publication has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions of Gartner's research organization and should not be construed as statements of fact. The opinions expressed herein are subject to change without notice. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered in Gartner research. Gartner's Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see "Guiding Principles on Independence and Objectivity" on its website, http://www.gartner.com/technology/about/ombudsman/omb_guide2.jsp

STRATEGIC PLANNING ASSUMPTION SaaS-based offerings will be used for 80% of all new North American e-signature purchases by 2013, compared with 15% in 2009. ANALYSIS During 2011, Gartner has seen increased and sustained client interest from multiple industries on the topic of e-signature. We have noted the following trends: More than 80% of the inquiries have been from North American clients. The cross-industry client interest is due in large part to the horizontal need that organizations have for signing contracts and other types of agreements. There is increasing need for mobile endpoint device support. SaaS is now the preferred delivery model. In 2009 and 2010, Gartner noticed increasing use of SaaS relative to on-premises software solutions; however, SaaS adoption remained in the minority during those years. This has changed in 2011, with SaaS adoption being the delivery model of choice for most customers. The main drivers for adopting e-signature are the same as they were when we published "North American and European Electronic Signature Suite and Service Market." Customers are looking for e-signature offerings that are secure, provide auditable evidence that appropriate processes have been followed, can be easily used by individuals for ad hoc signing and can be integrated with automated business processes. The goals are to enable more-rapid business process execution and to reduce costs. We attribute increased client interest in e-signature, particularly the interest in using SaaS based e-signature services, to commensurate increases in online business and organizational comfort with e-signature adoption. The Legal Issue, One More Time A significant minority of clients still express some concern about whether e-signing is legal or whether it will be legally acceptable to use e-signatures for their business processes. Gartner does not provide legal advice. However, we have seen enough court case summaries and have talked with enough organizations that have adopted e-signature-based processes and that have had these processes tested in court to reconfirm that e-signatures are legal and accepted in North American courts. The most recent and direct evidence can be found in the Arkansas Supreme Court's decision in Barwick v. Government Employee Insurance Co., Inc. Case No. 10-1076 (AR S.Ct., Mar. 31, 2011). We reiterate the importance of following good process when delivering e-signed transactions. See the process diagram and descriptions in "North American and European Electronic Signature Suite and Service Market." Enterprises considering SaaS e-signature services should understand vendors' functional offerings and pricing models. Potential customers should also structure deals and architect systems to mitigate the risk of vendor lock-in. Base Functions of E-Signature Services E-signature services are used by multiple customers and hosted on common infrastructures and software (SaaS model), or they are offered as dedicated hosted instances for individual customers. These services provide all or most of the functionality of a Web-based on-premises software suite. Established on-premises solutions will generally have the ability to orchestrate Publication Date: 18 August 2011/ID Number: G00215378 Page 2 of 6

more complex process workflows, and will have integration code for more endpoint signing devices, such as signature pads and integration with enterprise systems such as enterprise resource planning (ERP) or customer relationship management (CRM) systems. There are two primary use cases supported by e-signature services user-initiated and system-initiated and there are variants of the two: User-initiated Users upload a document for signature via a Web browser interface or through a desktop application menu or print driver. The document may be templated locally or may be recognized by the service as being a document that matches a template the user previously stored in the service library. The sender identifies signatories. System-initiated Enterprise applications or other SaaS applications call the service and send documents for signing via a Web service. Signatory lists are predefined or included as part of the delivery stream to the service. Integration with other SaaS applications such as salesforce.com has become increasingly requested. In both use cases, the service notifies the signatories, usually via email that contains a link back to the service. Signatories may be further authenticated, have a chance to review and, in some cases, mark up the document using a mouse or stylus, and then sign the document. "Click-tosign" is the most common type of electronic signature used with SaaS offerings. Although vendors may offer voice signature and biometric handwritten signatures that use a stylus or some other pointing method. The service may convert the document to a common format, usually a PDF if not already in that format. The service provider may simply apply a cryptographic hash to the file or digitally sign the file using the SaaS vendor's X.509 credential as an integrity mechanism. Contextual information, such as date, time, IP address of the signing device, and its geolocation may be stored within the document or noted in an audit record. This contextual information and authentication and the integrity properties are usable for evidence if needed. The documents and an associated audit summary may be stored at the service provider, sent back to the calling application for storage or both, depending on customer requirements. Most customers obtain and retain the documents and have those documents purged from the e-signature service providers services, while the service retains a hash of the document and the audit data. Clients should request that providers digitally sign final form PDFs with a key linked to a publicly rooted certificate recognized and "trusted" by current and recent versions of Acrobat Reader particularly if this function is offered at no extra charge. This prevents the document's viewer from getting error messages pertaining to the signature or certificate not being recognized or trusted. This should not be a major issue due to the other evidence collected by the service, but having the signature show up as valid and trusted means one less thing to explain in court should documents be viewed there. E-signature vendors offer different forms of authentication to the service, with password authentication being the most common, but the vendor may also partner with third-party identity proofing or authentication services to support customers who have higher assurance needs. Most customers do not feel they need these additional controls. More SaaS providers include the ability for signatories to print a document, sign it manually and fax it back to the service. There is usually a bar code or some other code to link the faxed record with the document in the system. Publication Date: 18 August 2011/ID Number: G00215378 Page 3 of 6

Mobility More Gartner clients have inquired about e-signature providers' abilities to enable signing on smartphones and tablets. The requirements are for customers, and, more frequently, for employees who work with their customers on-site, such as insurance agents and sales representatives. Smartphones are often poor candidates for document review and signing due to small screen size; however, they may be sufficient for simple and short documents. The phone may be used for countersigning by parties already familiar with document content who simply want to execute an agreement. All SaaS e-signature vendors can support Web-browser-based click-to-sign on mobile platforms. We have seen some interest in using stylus or finger-based handwritten signature on tablets, and vendors are just beginning to support that capability. Disconnected signing that is, the ability to sign locally on a tablet without being online with the service and subsequently connecting and uploading to the service is nascent, but availability should grow within the next two years. This requirement is important for those who travel regularly and must work with signatories in places that have poor connectivity. Which Are the Vendors and What Are the Major Market Changes Since 2010? The following vendors have SaaS offerings: Adobe, AlphaTrust, AssureSign, DocuSign, RightSignature, Sertifi and Silanis (see "North American and European Electronic Signature Suite and Service Market" for more information about these vendors). DocuSign has been in the business of delivering document signature as SaaS the longest and has the largest market share. Adobe purchased EchoSign in July 2011, when EchoSign was second in market share. The rest of these vendors follow DocuSign and Adobe with relatively low market share. RightSignature is the newest vendor on the market, and its entry is more evidence of the rise in interest for SaaS-based offerings. We do not yet have customer reference data points for this vendor. Silanis has been providing on-premises electronic signature software and implementation services for more than a decade. In the past 18 months, it has offered a dedicated hosted version of its software, a SaaS product that is based on the IBM LotusLive platform, and a stand-alone SaaS offering. Signix offers a hosted service that is dedicated and can be customized for each client. Unlike the other services, Signix completely uses digital signatures for its signing processes. Signix manages the key pairs used for signing so that customers don't have to deal with issues of key management on endpoint devices. All vendors have the fundamental processes for uploading, routing, and signing documents well in hand. There is little differentiation for basic workflows. Vendors add features often, and differentiation is usually established through integration with other SaaS platforms (e.g., salesforce.com, workflow support for industry specific-processes such as loans, or real estate transactions), and there is near-term differentiation in supporting disparate mobile endpoints. Although this will likely cease to be a differentiating feature set within two years. Enterprises may pay a price premium for using market leaders' services, and may be paying for unneeded features. Organizations with simple, ad hoc signature requirements who can tolerate vendor viability risks will likely find less expensive offerings from the vendors with lower market share. Changing providers for user initiated ad hoc processes is relatively easy and comes with little risk. Publication Date: 18 August 2011/ID Number: G00215378 Page 4 of 6

Organizations that integrate their on-premises systems with SaaS e-signature offerings should create a software abstraction layer between their systems and calls to the vendors' application programming interface (API) or Web service. This layer would allow enterprise systems to call "transmit document," "add recipient" or "receive signed document" functions, and the layer would broker these calls to the incumbent vendors' API to invoke the vendor's services. Changing to a different e-signature vendor would require code changes to the vendor API side of the abstraction layer, but this should be able to be minimized on the calling applications side. Changes to applications should be limited to different features of the new vendor's system relative to the old vendor's system. This will also limit changes needed to applications should the enterprise decide to adopt an on-premises solution. Pricing. Pricing for SaaS e-signature services is most commonly based on the transaction. A document or set of documents sent to the service and routed for signature constitutes a transaction. Price reductions come with higher usage. Subscription "per user/per month" models are also used. Adobe (EchoSign) favors this model. Enterprises should be armed with known or best estimates of transaction volumes needed to support business processes when negotiating with vendors using transaction pricing models. Factors to consider when evaluating SaaS versus on-premises solutions. SaaS e-signature services are not for every enterprise. Enterprises with the following requirements should strongly consider on-premises solutions: Internal development staff is established with experience in taking on new integration platforms, and the enterprise has a build-over-buy preference. There are multiple signature-based processes across multiple lines of business, and the calling application platforms and storage management architectures are heterogeneous. Integration with specialized signing devices, such as signature pads, is needed. Signature workflows are complex, with multiple signatures required with a mixture of parallel and serial signing workflows. Transaction volumes are high or unknown, but believed to be high. Enterprises are signing sensitive documents and do not want a third party involved. With the exception of the last point, enterprises may still find the use of SaaS e-signature services compelling if the needed feature sets are available from a SaaS provider, and an appropriate deal can be structured to keep costs below that for an on-premises software deal. RECOMMENDED READING Some documents may not be available as part of your current Gartner subscription. "North American and European Electronic Signature Suite and Service Market" "North American Life and P&C Insurance E-Signature Trends and Vendor Selection" "Hype Cycle for Identity and Access Management Technologies, 2011" Evidence Market research and Gartner client interactions. Publication Date: 18 August 2011/ID Number: G00215378 Page 5 of 6

REGIONAL HEADQUARTERS Corporate Headquarters 56 Top Gallant Road Stamford, CT 06902-7700 U.S.A. +1 203 964 0096 European Headquarters Tamesis The Glanty Egham Surrey, TW20 9AW UNITED KINGDOM +44 1784 431611 Asia/Pacific Headquarters Gartner Australasia Pty. Ltd. Level 9, 141 Walker Street North Sydney New South Wales 2060 AUSTRALIA +61 2 9459 4600 Japan Headquarters Gartner Japan Ltd. Aobadai Hills, 6F 7-7, Aobadai, 4-chome Meguro-ku, Tokyo 153-0042 JAPAN +81 3 3481 3670 Latin America Headquarters Gartner do Brazil Av. das Nações Unidas, 12551 9 andar World Trade Center 04578-903 São Paulo SP BRAZIL +55 11 3443 1509 Publication Date: 18 August 2011/ID Number: G00215378 Page 6 of 6