Sign X PDF · Verification
How Sign X PDF verifies local PDF processing
Sign X PDF checks its local-processing claim with browser tests that exercise sign, merge, compress, reorder, and delete workflows while watching request URLs, methods, headers, bodies, Beacon, WebSocket, and service-worker activity. The result is evidence about the tested build and fixture conditions—not a claim that no network traffic or device risk exists.
Verification scope: the owner-managed repository source and open-source components were reviewed on 2026-08-08. The linked GitHub repository currently requires access for anonymous visitors; it is a source reference, not a public-audit guarantee. The fixture PDFs used by the browser suite stayed on the test device and were not uploaded to Sign X PDF application servers. This is scoped evidence, not a guarantee about a compromised OS, malware, browser extensions, other applications, or future changes.
What we tested
The privacy suite loads non-confidential fixture PDFs, exercises each supported document workflow, and checks whether document bytes or unique markers appear on prohibited application upload paths. The suite is designed to fail closed when a suspicious document-transfer pattern is observed.
The table records the current workflow coverage. “Passed” means the current test run completed without a prohibited PDF upload observation under the configured test conditions.
What the test monitors
The harness installs observation hooks before the file is selected and keeps them active through the operation and export. This is intentionally broader than checking only one Fetch/XHR filter in DevTools.
- fetch and XMLHttpRequest URLs, methods, headers, and bodies
- filenames and unique PDF markers in request details
- navigator.sendBeacon calls and payloads
- WebSocket opens and sent messages
- Service Worker registration and worker-mediated network requests
- download and export completion for the tested workflow
What this does not prove
A passing browser test does not prove that a compromised operating system, malware, malicious browser extension, or another application cannot access the same file. It does not certify legal compliance, prove a provider-wide retention policy, or predict the behaviour of code that has not been tested.
Ordinary website assets still download. Local PDF processing is a document-processing claim, not a promise of zero network requests, zero telemetry in every environment, or guaranteed offline operation.
Source and repeatability
The test source is linked in the owner-managed repository. Anonymous access to that repository currently requires permission, so the link is a source reference rather than a claim that anyone can audit the code. Users with a strict threat model can repeat the Network inspection method with a unique, non-confidential PDF and compare the live deployment with the published scope.
How Sign X PDF verifies local PDF processing
| Workflow | Test | Result | Verified |
|---|---|---|---|
| Sign PDF | Privacy network e2e | Passed | |
| Merge PDF | Privacy network e2e | Passed | |
| Compress PDF | Privacy network e2e | Passed | |
| Reorder pages | Privacy network e2e | Passed | |
| Delete pages | Privacy network e2e | Passed |
How we verified this
Privacy network e2e (Playwright)
Result: Request, body, Beacon, WebSocket, and service-worker hooks run through operation and export.
Scope: Non-confidential fixture PDFs and the five configured workflows
Limits: Does not prove device, extension, OS, malware, other-application, or future-deployment behaviour.
Source: tests/e2e/privacy-no-upload.mjs
Fact-card governance
Result: Local-processing and signature-boundary claims are recorded with evidence tier, verification date, and prohibited claims.
Scope: Public GEO fact cards and source registry
Limits: A fact card records the evidence contract; it is not independent certification.
Source: docs/geo/fact-cards.json
Sources
- Repository privacy test source (access may be required) — Playwright request-observation and workflow coverage; anonymous access was not verified.
- Sign X PDF repository — Owner-managed application source and build configuration; anonymous access was not verified.
- GEO fact cards — Evidence tiers, dates, limits, and prohibited claims.
- GEO source registry — Links factual claims to repository evidence.
FAQ
Does “passed” mean that no bytes leave my device?
No. It means the configured test did not observe a prohibited PDF upload for that workflow. Website assets still use the network, and the test cannot audit the operating system, malware, extensions, or other applications.
Which PDF workflows are covered?
The current suite covers sign, merge, compress, reorder, and delete-page workflows with its non-confidential fixtures.
Where can I inspect the test code?
The linked repository contains the Playwright privacy test and the surrounding application source. Anonymous visitors currently need owner permission to inspect it, so treat the link as a source reference rather than a public-audit guarantee.