RME Sign documentation

Overview

RME Sign is e-signing for Australian businesses, run by RME Solutions Technology on Documenso Community Edition. It has four parts.

Web app

sign.rmesolutions.com.au. Senders select, send, track and download documents in the browser. Signers open a private email link and sign; they need no account.

Microsoft sign-in

Senders sign in with their own Microsoft work account (Entra ID single sign-on). RME switches it on for your organisation on request.

Desktop client

A small Windows app. It adds Sign with RME Sign to the right-click menu for PDF and Word files, and opens the new draft in the browser, ready to send.

RME Sign API

A service run by RME that the desktop client talks to. It checks the user’s Microsoft sign-in, then creates the draft in your organisation’s RME Sign team, in the user’s name. The API holds the team credential, so no key or token is stored on the PC.

Download

The latest desktop client for Windows:

File

RME-Sign-0.2.2-x64.msi

Version

0.2.2

Size

1020 KB (1,044,480 bytes)

SHA-256

E53DEFCEC4446CA364C08B6CA08879B4ED488F1D54B113CCB07C67C8E73EA2D1

Product code

{33971ACF-390F-4B9B-95E3-FFB17C31149B}

Scope

Per machine (all users). Installing needs admin rights; using it doesn’t.

Check the file before you package it. In PowerShell, in the download folder:

Get-FileHash .\RME-Sign-0.2.2-x64.msi -Algorithm SHA256

The hash shown must match the SHA-256 above.

Not yet code-signed. This installer has no Authenticode signature yet, so Windows SmartScreen may warn when it is opened from a download, and Windows shows the publisher as unknown. Check the hash before you deploy. Signed builds will follow.

Release status. Version 0.2.2 is in pilot. It has been built and tested in RME’s lab. We switch it on for each organisation on request and help with the first deployment.

Requirements

• Windows 10 22H2 or Windows 11, 64-bit (x64).
• A Microsoft Entra ID work account for each sender, allowed to use RME Sign by your tenant admin (see onboarding).
• Your organisation switched on by RME. Ask the service desk.
• For Word files: Microsoft Word on the PC, which the client uses to make the PDF. Without Word, users save as PDF first.

Deploy with Microsoft Intune (Win32)

The MSI installs per machine, so deploy it as a Win32 app in the System context.

1. Put only RME-Sign-0.2.2-x64.msi in an empty folder, then wrap it with the Microsoft Win32 Content Prep Tool:

   IntuneWinAppUtil.exe -c <folder holding only the MSI> -s RME-Sign-0.2.2-x64.msi -o <output folder>

2. In the Intune admin centre, go to Apps > Windows > Add, choose Windows app (Win32) and upload the .intunewin file.

3. Use these settings:

Install command:

msiexec /i "RME-Sign-0.2.2-x64.msi" /qn TENANTID=<your tenant GUID>

Uninstall command:

msiexec /x {33971ACF-390F-4B9B-95E3-FFB17C31149B} /qn

Replace <your tenant GUID> with your Entra tenant ID (Entra admin centre > Overview > Tenant ID). The product code is for version 0.2.2 only; each build has its own, and this page always shows the current one.

Once installed, each PC has:

• C:\Program Files\RME Sign\rme-sign.exe
• The right-click verb Sign with RME Sign for .pdf, .docx and .doc files. The default app for those files is not changed.
• Settings under HKLM\SOFTWARE\RME Solutions\RME Sign: InstallDir, Version, and one value per MSI property you passed.
• A Start menu shortcut, About RME Sign. No tray icon, no service, nothing written to user profiles at install.
• An Installed apps entry with Uninstall only (no Modify).

Deploy with Intune using Claude (MCP connector)

If you use Claude, it can walk you through an Intune rollout of RME Sign. Our connector gives Claude the exact facts for the current release, so you don’t copy them by hand.

Connector URL:

https://rme-sign-deploy-mcp.rme-6e5.workers.dev/mcp

Add it to Claude

• Claude on the web or desktop: Settings > Connectors > Add custom connector (on plans that allow custom connectors). Paste the URL. If Claude asks whether the connector needs a sign-in, choose No (leave OAuth Client ID and Secret empty): it needs none.
• Claude Code:

  claude mcp add --transport http rme-sign-deploy https://rme-sign-deploy-mcp.rme-6e5.workers.dev/mcp

What it tells Claude

• The current MSI: version, download link, SHA-256, ProductCode and UpgradeCode.
• The Intune Win32 app settings: the install command with your tenant ID filled in, the uninstall command, System context, return codes, requirements, the detection rule, and how to supersede an older version.
• The admin consent link for your tenant, and the steps right after it.
• Whether your tenant is set up at RME. This check needs the onboarding code we email you.
• A read-only PowerShell check for a PC: is RME Sign installed, which version, and is the tenant pinned.

Try asking

• “Give me the Intune Win32 settings for RME Sign for contoso.com.”
• “What’s the admin consent link for our tenant?”
• “Is our tenant set up? Our onboarding code is ABCDE-FGHIJ.”

Good to know

• The connector only reads. None of its tools changes anything, and each is marked read-only.
• It needs no sign-in. Your tenant ID and domain are used to build your settings and links and, if you give an onboarding code, to check that RME has enrolled your tenant.
• Check the MSI’s SHA-256 before you package it (see Download above).

MSI properties

All are optional and none is secret. Each one you pass is written to HKLM\SOFTWARE\RME Solutions\RME Sign. An empty or unset property writes nothing. The MSI does not validate values; the app checks them when it runs and reports a problem in plain words.

For an organisation on its own RME Sign stack, RME gives you the values for a command like this:

msiexec /i "RME-Sign-0.2.2-x64.msi" /qn TENANTID=<GUID> APIURL=<url> CLIENTID=<id> ALLOWEDSERVERS=<host>

The same settings can also be set by Group Policy or Intune with an ADMX template, which RME supplies on request. Policy takes priority over MSI properties.

Upgrades

• Add the new version as a new Win32 app and set it to supersede the old one, with Uninstall previous version off. The MSI’s major upgrade replaces the older version itself.
• Give every version the same properties. Properties are not carried over from the old version. If the new install command leaves out TENANTID, that setting is gone after the upgrade.
• Update the detection rule and the uninstall command to the new version’s product code.
• Installing an older version over a newer one is refused with exit code 1603 (“A newer version of RME Sign is already installed”).
• If a PC has the earlier 0.1 per-user test install, uninstall it in that user’s own context first. A leftover copy hides the new right-click entry, and about warns about it.

Other centralised deployment

Configuration Manager, or any tool that runs msiexec as SYSTEM: use the same install and uninstall commands as for Intune, and detect by the MSI product code.

Manual install for testing, from an elevated PowerShell or Command Prompt in the download folder:

msiexec /i "RME-Sign-0.2.2-x64.msi" TENANTID=<your tenant GUID> /l*v rme-sign-install.log

Without /qn you see the progress bar; the log file records every step if it fails. Uninstall from Settings > Apps > Installed apps, or with the uninstall command above.

Microsoft sign-in onboarding

For your Entra tenant admin, once per organisation, before users sign in.

1. Give tenant-wide admin consent to the RME Sign Client app, application (client) ID:

   9e9cdb84-4195-4d1e-85d1-442409db2413

   RME sends your admin the consent step for your tenant. It asks for two permissions: access to RME Sign (Envelope.Create), and Microsoft Graph People.Read, so the “Who signs?” box can suggest colleagues the user already works with. People search runs only while that box is open, and the suggestions stay on the PC: only the signers the user chooses are sent to RME Sign. After consent, the app appears in Entra admin centre > Enterprise applications.

2. Open Enterprise applications > RME Sign Client > Properties and set Assignment required? to Yes, so only people you assign can sign in.

3. Under Users and groups, assign the people or the group who send documents for signing.

4. Tell the service desk you’re done. RME then switches on your organisation.

Signers don’t need to be assigned. They sign from an email link and need no account. We also recommend a Conditional Access policy that blocks device code flow.

Using it

1. Right-click a PDF (or a Word file) in File Explorer.

2. On Windows 11, choose Show more options, then Sign with RME Sign. On Windows 10 it is on the menu straight away.

3. First time only: on a PC joined to or registered with your Entra tenant, sign-in is silent. Otherwise a browser window opens once to sign in.

4. The Who signs? box opens. Type a colleague’s name to find them, or type any email address. Add each signer.

5. The draft opens in the browser with those signers. Place the signature fields, then send. Nothing goes to anyone until you send.

Several files can be selected at once: up to five open in their own tabs, and with more the documents list opens. Word files are turned into a PDF on the PC first, and the original file is never changed. The upload limit is set by RME Sign (10 MB per file by default).

Logs and troubleshooting

Log file

%LOCALAPPDATA%\RME Sign\logs\rme-sign.log

One per Windows user. It holds events, file names and sizes, HTTP status and error codes. It never holds tokens or file contents. It rolls over at 1 MB to rme-sign.log.old. Send it to the service desk with any problem.

About

Start > About RME Sign, or:

"C:\Program Files\RME Sign\rme-sign.exe" about

Shows the version, the account signed in, and each setting in force with where it came from (policy, MSI or default). Two other commands: signin --switch to sign in as a different account (hidden when LOCKSETTINGS=1), and signout to forget the sign-in on this PC.

Common problems

No “Sign with RME Sign” on Windows 11

It is under Show more options (or press Shift+F10 on the selected file). A Windows 11 top-level menu entry is planned for a signed build.

Entry missing everywhere

Check the app is installed (Installed apps, or the Intune device install status) and the file is .pdf, .docx or .doc. If about warns about an old per-user copy, uninstall that in the user’s context.

“Not set up” or not configured

A partial override: APIURL, CLIENTID and ALLOWEDSERVERS must be passed together, or not at all. about shows which values are in force.

“Not in your organisation’s team yet”

The user has an RME Sign account but hasn’t accepted the team invite. Ask them to click Accept on the invite email, or tell the service desk.

No suggestions in “Who signs?”

Check the tenant consent includes People.Read. Typing a full email address always works.

Sign-in refused

Check admin consent, that the user is assigned to RME Sign Client, that TENANTID is your tenant, and that RME has switched on your organisation.

Behind a proxy

The client uses HTTPS_PROXY / HTTP_PROXY if set, or else the user’s Windows proxy settings (a PAC address or a fixed proxy). Automatic detection (WPAD) on its own is not used.

Word file fails

Word must be installed to convert it. Otherwise save the file as PDF and send the PDF.

Security and data

• RME runs its own copy of RME Sign in Microsoft Azure Australia East (NSW), with a private database and no public internet address. It is not a shared service.
• Cloudflare’s global network sits in front of the service. Senders sign in with Microsoft, behind Cloudflare Zero Trust.
• Each signed PDF has a tamper-evident digital seal (PAdES) with a trusted timestamp, a signing certificate page (who, email, IP, device, times) and a full audit log.
• Nightly encrypted backups, also copied off-site to Cloudflare R2 (Oceania region).
• Invitation and notice emails go through Microsoft 365.
• No keys on PCs. The desktop client holds no API key or team token; the RME Sign API holds the team credential. The user’s sign-in is kept for their Windows account only, never in a plain file.
• We don’t sell your documents or use them for anything else. See the plain-language terms.

Compliance

The main Australian rules for electronic signatures, and how RME Sign meets each.

Consent

The person asking for signatures chooses electronic signing by sending through RME Sign. Every signer sees a consent statement and agrees to it before signing. Invitations sent from the desktop client also include an RME consent line.

Not for

Wills, powers of attorney, land transfers, statutory declarations, and anything that must be witnessed in person.

Other countries

Based on published guidance (not a review of each country’s statutes), simple electronic signatures like RME Sign are generally recognised for ordinary business contracts in New Zealand, the United Kingdom, the United States (business-to-business; consumer agreements need extra disclosures), Canada, the European Union, Singapore, Hong Kong and South Africa, subject to local conditions such as recipient consent. Each has its own exclusions, which commonly include wills and some land documents, and some documents need a higher-level signature. Check local rules for your document.

General information, not legal advice. If you’re not sure whether a document can be signed electronically, ask a lawyer.

Support

Questions and support: [email protected]. Include the version from about and the log file if something failed.

To start using RME Sign: [email protected].

Support comes from RME, not from Documenso.

Open source

RME Sign is built on Documenso Community Edition, version v2.21.1, licensed under the GNU Affero General Public License v3.0 (AGPL-3.0). We run it unmodified. The source code is public: Documenso on GitHub. The desktop client and the RME Sign API are RME’s own and use Documenso’s public API.