Valo Sign legal
Security
How the browser-only architecture reduces exposure, and where its boundary ends.
Last updated 24 August 2026
Plain-language noticeThese terms are designed for a South African service with global users. Mandatory rights under your local law still apply.
Local-first design
- PDF parsing, editing, signing, and export happen in the browser.
- Document URLs, blobs, signatures, form data, and exports are excluded from the service-worker cache.
- There are no third-party runtime scripts, analytics SDKs, or remote document processors in V1.
- Reloading, closing, or starting over clears the working session held by Valo Sign.
Application controls
The production design uses restrictive content-security rules, same-origin workers and fonts, no interactive PDF scripting, disabled XFA processing, local image validation, bounded file and image sizes, and export validation before download.
Your part
- Use an up-to-date supported browser and trusted device.
- Keep your original PDF and review the completed export.
- Treat downloads as sensitive and remove them when no longer needed.
- Consider disabling untrusted browser extensions when handling confidential material.
Limits
No browser application can protect against a compromised device, malicious extension, operating-system capture, memory inspection, or another person with access to your downloads. Local processing reduces server exposure; it does not make a device invulnerable.