Security Architecture

1. The Fundamental Security Guarantee: Zero Transmission

The most important security property of SignPDFOnline is architectural: your PDF files and signatures never leave your device. This is not a policy promise — it is a technical reality enforced by how the application is built.

SignPDFOnline is a static web application — a collection of HTML, CSS, and JavaScript files served to your browser. Once loaded, all document processing happens entirely within your browser's sandboxed execution environment using these client-side technologies:

• PDF.js (Mozilla): Decodes and renders your PDF pages inside the browser memory. No bytes leave your device during rendering.
• pdf-lib: Embeds your signature image into the PDF structure locally. The final signed PDF is assembled in browser memory and downloaded directly via the File API — no upload to any server occurs at any step.
• HTML5 Canvas API: Captures your drawn or typed signature as pixel data entirely within the browser's sandboxed canvas element.
• IndexedDB (browser local storage): Signatures saved to your library and the 5-minute session recovery buffer are stored exclusively in your browser's local IndexedDB. This data never touches our servers.

You can verify this yourself by opening your browser's Developer Tools → Network tab and loading a PDF. You will see zero outbound requests carrying your document content.

2. What Our Servers Actually Receive

Our web server's role is limited strictly to serving static files: HTML, CSS, JavaScript bundles, fonts, and the sample PDF. It receives only standard HTTP request metadata:

• Your IP address (standard for any web request, processed transiently by Hostinger infrastructure)
• Standard HTTP headers (browser user-agent, referrer, accept-language)
• The URL of the page you requested

Our servers do not receive: PDF file bytes, page content, document text, signature images, file names, session data, or any information about what you are signing.

3. Browser Security Sandbox

All document processing occurs within the browser's native security sandbox. Modern browsers (Chrome, Firefox, Safari, Edge) enforce strict memory isolation between browser tabs, the host operating system, and network interfaces. This means:

• Your PDF data is isolated inside the browser tab's memory space.
• JavaScript running on SignPDFOnline cannot access files elsewhere on your computer beyond what you explicitly select via the file picker.
• Browser same-origin policies prevent third-party scripts from reading your document data.
• Canvas data (your drawn signature) is isolated from other origins by browser security rules.

4. Security Headers

The SignPDFOnline web server is configured with the following HTTP security headers on all responses:

• X-Frame-Options: SAMEORIGIN — prevents clickjacking attacks by blocking the site from being embedded in iframes on other domains.
• X-Content-Type-Options: nosniff — prevents browsers from MIME-sniffing responses away from declared content types.
• Referrer-Policy: strict-origin-when-cross-origin — limits referrer information sent to third-party resources.
• Permissions-Policy — restricts access to sensitive browser APIs (camera, microphone, geolocation) that SignPDFOnline does not require.
• HTTPS / TLS — all connections are encrypted via HTTPS. HTTP requests are automatically redirected to HTTPS.

5. Session Recovery & Local Data Lifecycle

The 5-minute accidental-close recovery feature stores a temporary snapshot of your active session in your browser's IndexedDB. This storage:

• Lives exclusively on your physical device.
• Is automatically and permanently deleted after 5 minutes of inactivity or browser closure.
• Can be manually wiped instantly using the "Clear All My Local Data" button in the footer.
• Contains no document content bytes — only placement metadata (position, size, page number) and signature image data as base64 strings in your local browser database.

6. Third-Party Scripts

SignPDFOnline may load the following third-party resources:

• Google Fonts (fonts.googleapis.com / fonts.gstatic.com): Used for the Inter typeface and signature handwriting fonts. Google receives a font request but has no access to your document data.
• Google AdSense (pagead2.googlesyndication.com): When advertisements are active, Google's ad scripts run in a standard isolated display container. Ad scripts have no programmatic access to your PDF data, signature canvas, or IndexedDB contents. The browser's same-origin policy enforces this isolation.

No other third-party JavaScript analytics, tracking pixels, or data collection scripts are loaded by default.

7. Input Validation

When you select a PDF file, the application validates it locally:

• File type is validated against the application/pdf MIME type and magic bytes before parsing.
• Signature image uploads accept only PNG, JPEG, and WebP formats, validated client-side.
• File size handling is managed within available browser memory. No upload occurs so server-side impact is not possible.
• Filenames displayed in the UI are sanitized to prevent injection of HTML or script content.

8. Responsible Disclosure

If you discover a security vulnerability in SignPDFOnline, please report it responsibly before public disclosure. Email a description to hi@signpdfonline.in with the subject line "Security Disclosure".

We will acknowledge receipt within 48 hours and work to address verified vulnerabilities promptly.

9. Honest Limitations

In the interest of accurate disclosure, we cannot protect against:

• Device-level compromise: Malware, spyware, or keyloggers already running on your device could intercept locally processed content.
• Malicious browser extensions: Some extensions have elevated page-access privileges. Use trusted browsers with reviewed extensions.
• Legal admissibility: Security architecture does not confer legal validity across all jurisdictions. See our Legal Disclaimer.