Operations & Compliance package
Submit a policy, contract or procedure as a PDF; reviewers read it in a PDF viewer and redline it, legal checks it when needed, and the owner e-signs. Every step is audit-logged.
About this package
Contract and policy review with internal e-sign takes a policy, contract or procedure from draft to published version using only UserTasks features and the official form controls. The submission page has three steps and a review step: the title, the document type (looked up in the Document types table, which shows its review route on an Info card), the effective date, the PDF itself (an Attachments field limited to PDF, previewed in a PDF viewer), the owner, reviewers and a Rich text summary of the changes.
The Document review and sign-off workflow gives the document a reference number, takes its review route from a decision table (one or two reviewers, legal review or not, days per review) and adds it to the Documents register. Each reviewer gets a task that shows the uploaded PDF in the PDF viewer, an Info card with the reference, type, version and owner, and a Rich text box for redline comments, with Approve or Request changes. Requested changes go back to the submitter with an SLA to upload a revised PDF, which then starts again at the first reviewer as the next version. Contracts and major policy changes also get a legal review.
Finally the document owner signs it off: they read the final PDF, confirm "I approve this version for publication" and sign with the Signature control. The workflow records the signer, time, file name and SHA-256 checksum, generates a sign-off certificate PDF (also merged with the document into a signed pack) and emails it. Every step writes a row to the Audit log data table with the 7-year retention policy applied, and the register row gets the same policy.
The Document register page is the dashboard: Chart controls of documents by status and by type from the register, the review cycle time and open review tasks as Saved reports, and a button that emails the published documents due for review in the next 30 days.
Starts from a form page: share the Document review request page (/f/<id>) with the people who own policies, contracts and procedures, or submit it through the forms API.
Someone fills in a form to start it: the workflow start form (Run dialog in the app, or your own portal posting to the API) or a standalone form page (/f/<id>) whose Form submitted trigger starts the workflow. People complete User Task forms along the way.
How forms workThe flow
Submit
The owner of a document fills in three steps: title and type (its review route shows on an Info card), the PDF with a live preview, then the owner, reviewers and a rich-text summary of changes.
Route and register
A reference number, the review route from a decision table, a Documents register row and the first Audit log row.
Review
Each reviewer reads the PDF in the PDF viewer, writes redline comments in Rich text and approves or requests changes; a second reviewer and legal review follow when the route says so.
Revise
Requested changes go back to the submitter with an SLA to upload a revised PDF; the new version starts again at the first reviewer.
E-sign
The document owner confirms "I approve this version for publication" and signs with the Signature control; signer, time, file name and SHA-256 go into the Audit log.
Certificate and register
A sign-off certificate PDF is generated, merged with the document and emailed; the register shows the document as Published with its next review date, and both records get the 7-year retention policy.
Track
The Document register page charts documents by status and type, shows the review cycle time and open review tasks, and emails the reviews due in the next 30 days.
Forms
People start it from a form page (/f/<id>) with its own header, theme and buttons; submitting it starts the workflow. User Tasks show their fields and outcome buttons to the assignee.
Form page · /f/<id>
2-column grid · own header and theme · Its own page: share the link or open it on a tablet
Form page · /f/<id>
Submit a document for review · own header and theme · Its own page: share the link or open it on a tablet
User Task
Review: {{form.title}} v{{version}} ({{reference}}) · 2-column grid · own header and theme
User Task
Second review: {{form.title}} v{{version}} ({{reference}}) · 2-column grid · own header and theme
User Task
Legal review: {{form.title}} v{{version}} ({{reference}}) · 2-column grid · own header and theme
User Task
Sign off: {{form.title}} v{{version}} ({{reference}}) · 2-column grid · own header and theme
User Task
Revise: {{form.title}} v{{version}} ({{reference}}) · 2-column grid · own header and theme
Form controls
The forms use these controls from the gallery. They come inside the package and install into Extensibility → Form controls, sandboxed and signed like every official control: nothing else to download.
From your code
Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.
REST
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
-H "Authorization: Bearer $USERTASKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"workflow_id":"<workflow id>","variables":{"title":"Information security policy","doc_type":"Policy","change_size":"Major change","route_summary":"Policy: 1 reviewer for a minor change, 2 reviewers and legal review for a major one; signed off by the document owner; reviewed every 12 months.","doc_owner":"$owner","doc_owner_name":"Avery Example","doc_owner_email":"avery.example@example.com","reviewer":"$owner","effective_date":"2026-12-01","version_label":"2026.2","change_summary":{"html":"<p>Adds a section on personal devices and shortens the password rotation rule to match current guidance.</p>","text":"Adds a section on personal devices and shortens the password rotation rule to match current guidance."}}}'CLI
usertasks workflows inputs <workflow id> # the start form: keys, types, required
usertasks workflows run <workflow id> --input title="Information security policy" --input doc_type=Policy --input change_size="Major change" --input route_summary="Policy: 1 reviewer for a minor change, 2 reviewers and legal review for a major one; signed off by the document owner; reviewed every 12 months." … --waitWhat's included
| Type | Name | Details |
|---|---|---|
| Email template | Changes requested on your document | Sent to the submitter when a reviewer, legal or the signer asks for changes; the revision task is waiting for them. |
| Email template | Document signed off | Sent to the submitter and the document owner when the document is signed off, with the sign-off certificate attached. |
| Email template | Document submitted for review | Sent to the person who submitted a document: its reference and the review route. |
| Email template | Reviews due soon | The summary someone asks for from the Document register page: published documents whose next review falls within the chosen number of days. |
| Data table | Audit log | One row per step of every document review: who did what, when, on which version, and the outcome. The sign-off row records the signer, the time, the file name and its SHA-256 checksum. Rows get the 7-year retention policy as they are written. |
| Data table | Document types | The kinds of document that go through review, with what each one needs: how long its records are kept, who signs it off and how often it is reviewed again. The submission form looks the type up here; the workflow reads the row. |
| Data table | Documents register | Every controlled document: its current version, status (In review, Changes requested, Awaiting sign-off, Published, Withdrawn), effective date, who signed it off and when it is next reviewed. |
| Decision table | Review route | 5 rules — Decides how many reviewers a document needs, whether legal reviews it and how many days reviewers get, from the document type and the size of the change. Edit the rows to match your governance. |
| Retention policy | Document records: 7 years | Review audit rows and document register rows are kept for 7 years after they are written, then reviewed before anything is deleted. The workflow applies it to every Audit log row and to the register row it signs off; change the period to your records schedule. |
| Report | Documents by status | Document review runs by their current status (In review, Changes requested, Awaiting sign-off, Published, Withdrawn), from the run variables. |
| Report | Open review tasks | Reviews, legal checks, revisions and sign-offs that are not done yet, with their due dates (the Document review and sign-off workflow's tasks). |
| Report | Review cycle time by document type | Average days from submission to sign-off and average review rounds, per document type (workflow variables of signed-off runs). |
| Form control | Chart | Bar, line, area, pie or doughnut chart of static data, another field's rows, lookup results or a saved report. Keyboard-navigable points, a data table view, and optional point selection. |
| Form control | Info card | A callout or key / value card: an info, success, warning, error or neutral message that can show up to six other form values ({{field1}} … {{field6}}), formatted for the reader. |
| Form control | PDF viewer | Shows a PDF inside the form (a contract, a quote, a policy) from an Attachments field or an upload: page by page, with zoom, rotation and the page text for screen readers. |
| Form control | Rich text | A rich-text editor with bold, italic, underline, headings, lists, quotes and links, a character counter and strict sanitising of everything typed, pasted or dropped. |
| Form control | Saved report | Shows a saved report as a sortable, paginated table or a chart, run with the permissions of the person filling in the form. Optionally pick a row as the field's value. |
| Form control | Signature | Draw a signature with a finger, pen or mouse, or type a name. Saved as a trimmed PNG in the form's attachments. |
| Form | Document register | The document control dashboard: register by status and type (charts from the Documents register table), review cycle time and open review tasks (saved reports), and a button that emails the reviews due soon. |
| Form | Document review request | Submit a policy, contract or procedure for review and internal e-sign: title, type (its review route comes from the Document types table), owner, the PDF (previewed in a PDF viewer), effective date, reviewers and a rich-text summary of what changed. |
| Workflow | Document review and sign-off | 63 steps — A policy, contract or procedure from submission to publication: reference number, review route from a decision table, reviewer tasks with the PDF in a viewer and rich-text redlines, a revision loop back to the submitter with an SLA, optional legal review, owner e-sign, a sign-off certificate PDF, the Documents register and a step-by-step Audit log with 7-year retention. |
| Workflow | Reviews due summary | 8 steps — From the Document register page: lists the published documents whose next review falls within the chosen number of days (and those already overdue) and emails the list to whoever asked. |
Audit log · 4 sample rows
ReferenceWhenStepWhoOutcomeVersionDocumentDetail
Document types · 3 sample rows
TypeDescriptionReview route (shown on the form)Signed off byKeep records (years)Review again after (months)Active
Documents register · 11 sample rows
ReferenceTitleTypeOwnerStatusVersionEffectiveNext reviewSigned off bySignedReview cycle (days)FileSHA-256
Requirements
Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.
Nothing: it installs complete.
Install
Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.
curl -fLO https://usertasks.com/gallery/contract-policy-review-esign-1.0.0.utpkg
usertasks packages inspect contract-policy-review-esign-1.0.0.utpkg # offline: checksum, hashes, signature
usertasks packages install contract-policy-review-esign-1.0.0.utpkg --dry-run
usertasks packages install contract-policy-review-esign-1.0.0.utpkg # prompts for each requirement
usertasks packages install contract-policy-review-esign-1.0.0.utpkg --keep-incomplete --yes # in CI; finish with:
usertasks packages complete contract-policy-review-esign -f values.yamlVerify the download
shasum -a 256 contract-policy-review-esign-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.
Versions
Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work
More packages
Operations & Compliance Official
Handle access, erasure and other privacy requests: statutory deadline, identity check, search of CRM, billing and support, erasure, and a DPO-approved reply.
Needs:REST APIAssigneesEmail
Operations & Compliance Official
Anyone raises a risk on a form; a 5×5 matrix rates it, the owner accepts, mitigates or escalates within an SLA, and a weekly job re-reviews due risks.
Nothing to configure: works as soon as it is installed
Operations & Compliance Official
A safety-themed incident form, severity and SLA from a decision table, an incident register with 7-year retention and an investigation task with Close / Escalate.
Nothing to configure: works as soon as it is installed