What's New in SignQuick — May 2026

May has been a heavy shipping month. Here's the digest of what changed, why, and where to find it.

If you want the precise list with PR numbers, see the full changelog.

Spanish (es-419) is live

The biggest item: `es.signquick.org` is now live, with end-to-end Spanish across marketing, the entire authenticated app, the signing experience for recipients, and the audit-trail PDF.

A few details worth knowing:

• Recipient language is locked at send time. When you add a recipient, you choose the language they'll receive the document in (English or Spanish). That language drives the signing-page UI, the email they get, and — importantly — the audit-trail PDF. The language a signer agreed to and the language recorded in the audit trail will always match.
• Sender language is per-user. The dashboard, settings, and reminder emails follow the language preference on the user's profile. You can switch any time from Settings → Account.
• Brand names stay English in both locales. "SignQuick", "ESIGN Act", "Stripe", and similar product names don't get translated. Tier names like "Pro" and "Team" also stay in English since they're product proper nouns.

If your browser's preferred language is Spanish but you land on `signquick.org`, you'll see a one-time banner offering to switch you to `es.signquick.org`. Dismiss it once and it won't come back.

Signature verification UX

Every completed document now has a verification card on the document detail page. It shows:

• The original-file SHA-256 hash and the signed-file SHA-256 hash.
• The certified timestamp authority and timestamp issued-at date.
• Download links for the signed PDF, the audit-trail PDF, and the timestamp token.

Below that, there's a public verifier at `/verify/`. Anyone — including counter-parties who don't have a SignQuick account — can drop the signed PDF into the verifier and confirm its hash matches the one we recorded. The verification runs entirely in the browser via `crypto.subtle`, so the verifier never uploads the PDF anywhere. The audit-trail PDF also embeds a QR code that points at this verifier, so a printed audit trail still leads back to a working integrity check.

This is the kind of feature you should never need to use. It's there so that the day you do need it — a contract dispute, a compliance audit, a question from your accountant — there's a clean answer ready.

Templates: folders, personal, duplicate, edit-after-create

Templates got a focused round of UX work:

• Folders — flat-namespace tags you can attach to any template, with a folder filter at the top of the templates list. Useful when your library grows past a single screen.
• Personal templates — when you create a template, you can choose whether it's visible to your whole organization or just to you. Default stays "shared" (the prior behavior). Every template card now also shows a "by [creator]" badge so you can see authorship at a glance.
• Duplicate — every template has a Duplicate action that creates `Template Name (copy)` with the same fields, variables, and gates. Tier limits apply.
• Edit after create — the template detail page now has an Edit button that takes you back into the new-template wizard pre-populated with the existing template's fields and variables.
• Pre-load PDF + fields — when you create a document from a template, the template's PDF and field placement are pre-loaded into the editor. You can still replace the PDF; if you do, fields reset with a one-line warning.
• Compliance gates inherited — gates configured on a template (identity verification, access codes, etc.) are inherited as locked policy on documents created from that template. Senders can't relax them per-document.
• Soft-delete — deleting a template no longer hard-removes the row. Existing documents that reference the template still load, and the audit trail continues to point at it.

Document activity feed

The document detail page used to have just an audit log. Now it has a unified activity timeline that combines:

• Email events from Resend (delivered, opened).
• Form-level telemetry (form viewed, form started, page-by-page dwell).
• The existing audit-log events (sent, viewed, signed, completed).

So if a recipient says "I never got the email," you can see whether it was delivered and whether it was opened — without leaving the document.

Bilingual ESIGN/UETA disclosure

Spanish recipients now see the full electronic-records consumer disclosure in Spanish — Scope, Right to a paper copy, Right to withdraw consent, Hardware/software requirements, Updating contact info, and Legal validity. Both languages share `version: 'esign_disclosure_v1'` because the version is the legal commitment; the language is just how that commitment is rendered. We store the locale separately on each recipient so the audit trail knows which language each signer actually saw.

We also rebuilt the consent modal to keep the header and footer pinned while the body scrolls. Previously the scrollbar covered the title and the Decline/Continue buttons could disappear off-screen on shorter viewports.

Polish, performance, and reliability

A few things that aren't a feature but make the product feel right:

• Spanish dashboard dates now render in Spanish. "hace 7 horas" instead of "7 hours ago"; "30/1/2026" instead of "1/30/2026"; analytics chart axes in the visitor's locale. The fix replaces every direct `date-fns`/`toLocaleDateString` call with `next-intl`'s locale-aware formatters, across documents, contacts, dashboard, bulk-send, settings, and analytics.
• /templates/new had an intermittent hydration error firing in Sentry for about a month. Tracked it down to `react-pdf` evaluating browser-only APIs during SSR; fixed by lazy-loading the PDF viewer with `ssr: false` in the field-editor and template preview.
• /sign/[token] had a separate intermittent React DOM error caused by the disclosure modal unmounting too aggressively when the signer accepted. The modal now stays mounted across the transition; we also added belt-and-suspenders translate guards (`` plus a `notranslate` class) since Chrome 147 doesn't always honor `translate="no"` on a child div.
• "Access denied" on the consent step — Vercel BotID was occasionally false-positiving real signers. We changed BotID from an auth gate to an observability signal: bot heuristics are now logged to Sentry as breadcrumbs without blocking the request. The signing token is the only authorization on `/api/sign/consent`, `/api/sign/complete`, and the public verifier.
• Vercel preview comments were being blocked by our CSP. Allowed `vercel.live` in `frame-src`.
• Comparison pages (`/vs/docusign`, `/vs/pandadoc`) are now Spanish-localized.

What's next

The bilingual launch was a milestone but the work isn't done. On the queue: app-shell `