Sign X PDF · Verification
How Sign X PDF verifies local PDF processing
Sign X PDF checks its local-processing claim with browser tests that exercise sign, merge, compress, reorder, and delete workflows while watching request URLs, methods, headers, bodies, Beacon, WebSocket, and service-worker activity. The result is evidence about the tested build and fixture conditions—not a claim that no network traffic or device risk exists.
Verification scope: the public repository source and open-source components were reviewed on 2026-08-08. The published source is available for inspection, but it remains a source reference rather than independent security certification. The fixture PDFs used by the browser suite stayed on the test device and were not uploaded to Sign X PDF application servers. This is scoped evidence, not a guarantee about a compromised OS, malware, browser extensions, other applications, or future changes.
What we tested
The privacy suite loads non-confidential fixture PDFs, exercises each supported document workflow, and checks whether document bytes or unique markers appear on prohibited application upload paths. The suite is designed to fail closed when a suspicious document-transfer pattern is observed.
The table records the current workflow coverage. “Passed” means the current test run completed without a prohibited PDF upload observation under the configured test conditions.
What the test monitors
The harness installs observation hooks before the file is selected and keeps them active through the operation and export. This is intentionally broader than checking only one Fetch/XHR filter in DevTools.
- fetch and XMLHttpRequest URLs, methods, headers, and bodies
- filenames and unique PDF markers in request details
- navigator.sendBeacon calls and payloads
- WebSocket opens and sent messages
- Service Worker registration and worker-mediated network requests
- download and export completion for the tested workflow
What this does not prove
A passing browser test does not prove that a compromised operating system, malware, malicious browser extension, or another application cannot access the same file. It does not certify legal compliance, prove a provider-wide retention policy, or predict the behaviour of code that has not been tested.
Ordinary website assets still download. Local PDF processing is a document-processing claim, not a promise of zero network requests, zero telemetry in every environment, or guaranteed offline operation.
Source and repeatability
The test source is linked in the public repository so anyone can inspect the published source and repeat the documented method. Users with a strict threat model can repeat the Network inspection method with a unique, non-confidential PDF and compare the live deployment with the published scope.
How Sign X PDF verifies local PDF processing
| Workflow | Test | Result | Verified |
|---|---|---|---|
| Sign PDF | Privacy network e2e | Passed | |
| Merge PDF | Privacy network e2e | Passed | |
| Compress PDF | Privacy network e2e | Passed | |
| Reorder pages | Privacy network e2e | Passed | |
| Delete pages | Privacy network e2e | Passed |
How we verified this
Privacy network e2e (Playwright)
Result: Request, body, Beacon, WebSocket, and service-worker hooks run through operation and export.
Scope: Non-confidential fixture PDFs and the five configured workflows
Limits: Does not prove device, extension, OS, malware, other-application, or future-deployment behaviour.
Source: tests/e2e/privacy-no-upload.mjs
Public verification source
Result: The public repository publishes the redacted application source, privacy test, and documented claim boundaries.
Scope: Public source tree and verification README
Limits: Published source and tests are scoped evidence, not independent security certification.
Source: README.md
Sources
- Repository privacy test source — Playwright request-observation and workflow coverage.
- Sign X PDF public repository — Public application source, MIT licence, build configuration, and contribution context.
FAQ
Q1 Does “passed” mean that no bytes leave my device?
A1 No. It means the configured test did not observe a prohibited PDF upload for that workflow. Website assets still use the network, and the test cannot audit the operating system, malware, extensions, or other applications.
Q2 Which PDF workflows are covered?
A2 The current suite covers sign, merge, compress, reorder, and delete-page workflows with its non-confidential fixtures.
Q3 Where can I inspect the test code?
A3 The public repository contains the redacted Playwright privacy test and the published application source. You can inspect the source and repeat the documented method, but the result remains scoped evidence rather than an independent security certification.