Security & privacy
Trust boundaries you can see.
PDFrig assumes a PDF can be sensitive and hostile at the same time. Controls protect tenant boundaries, preserve originals, constrain parsers, and keep content out of diagnostics.
Development draft — this page is local product evidence, not an approved public policy or legal commitment.
Local-first where it is reliable.
Local browser and Windows workflows do not silently upload. The Windows webview has a deny-by-default native surface, no remote application code, user-mediated file access, DPAPI-protected sessions, and signed bounded entitlement snapshots.
Tenant and cloud isolation.
- Workspace membership is resolved from the authenticated session, never a client owner ID.
- Every exposed table uses Row Level Security with anonymous and cross-tenant negative tests.
- Private storage uses opaque keys and short, method-bound grants.
- Workers are non-root, network-restricted, resource-bounded, and operate on immutable inputs.
- Cloud completion never depends on a billing redirect; verified server state is authoritative.
Content-free operations.
Logs, traces, analytics, alerts, and ordinary support prohibit document bytes and text, filenames and paths, PDF passwords, signature images, form values, object keys, signed URLs, auth tokens, cookies, and raw webhook bodies.
Independent work still required.
Public beta remains gated on an independent penetration test, production threat review, provider and regional approval, signed Windows reference-machine testing, alert delivery, restore exercises, and a reviewed security-reporting channel. Development evidence is not a certification or a claim of universal compliance.
Privacy contact placeholder: privacy@example.invalid