A PDF editor for documents you cannot upload

The awkward moment in a lot of professional workflows is small and routine: four scans need merging, a bundle needs numbering, a form needs filling. The obvious tools are free web converters, and each of them begins by asking you to hand over the file.

For most documents that is fine. For some of them it is a disclosure.

Who this is built for

• Legal — discovery bundles, client correspondence, anything privileged. Bates numbering runs locally across a whole folder.
• Healthcare — assessment forms, referrals, records with a named person and a clinical finding on the same page.
• HR — contracts, disciplinary files, candidate documents.
• Finance and accounting — statements, filings, client records.
• Government and regulated industry — where an outbound connection may simply be prohibited.
• Journalism and research — source material that must not touch a third party.

What "never uploaded" actually means

Your browser reads the file from your disk into the tab's memory. Rendering, page changes, text replacement, stamps, numbering, form filling and export all run on your own processor. The exported file is created in memory and saved by your browser straight to your downloads folder. Closing the tab releases everything.

We hold no copy at any point, and could not produce one if compelled, because we never received one.

Three ways your IT team can verify it

1. The Content Security Policy. The editor is served with a policy permitting no third-party origin at all. Your browser enforces that, not us — check the response headers.
2. The network tab. Load a document, edit it, export it. After the application files arrive, there is no further traffic.
3. Disconnect. Pull the network connection and keep working. Software that needed to transmit could not.

For locked-down environments

The whole editor compiles to a single HTML file of about two megabytes. Put it on an internal share and the organisation has a PDF editor with no data path out — no installer, no service, no licence server, no update mechanism, no vendor account. For teams that cannot approve installed software, this is often the only route to a PDF editor that clears review.

What it will not do

It does not redact. Covering text with a filled shape hides it visually and leaves it selectable underneath — a mistake that has exposed names and figures in real cases. True redaction is on the roadmap and is not shipped. Do not use any shape tool here as a substitute.

Signatures are visual, not cryptographic. They look like a signed page, which is what most documents require, but carry none of the assurances of a digital certificate.