Security

Local-first design

• PDF parsing, editing, signing, and export happen in the browser.
• Document URLs, blobs, form data, and exports are excluded from the service-worker cache. A signature you explicitly save is stored separately in local browser storage until you remove it.
• The Google Analytics tag is the only optional third-party runtime script and loads only after consent. It is separated from document state and receives no document-derived information.
• Reloading, closing, or starting over clears the PDF working session. It does not remove a signature you chose to save.

Application controls

The production design uses restrictive content-security rules, same-origin workers and fonts, no interactive PDF scripting, disabled XFA processing, local image validation, bounded file and image sizes, and export validation before download.

Your part

• Use an up-to-date supported browser and trusted device.
• Keep your original PDF and review the completed export.
• Treat downloads as sensitive and remove them when no longer needed.
• Consider disabling untrusted browser extensions when handling confidential material.

Limits

No browser application can protect against a compromised device, malicious extension, operating-system capture, memory inspection, or another person with access to your downloads. Local processing reduces server exposure; it does not make a device invulnerable.