We can't
read it. By design.

The model in plain English

1. Your browser makes a key. When you send a contract, your browser generates a random 256-bit key. It never leaves your device except inside the links you share.
2. Everything is locked before upload. The PDF, its fields, the signer list and your message are encrypted with AES-256-GCM, the same standard banks and governments use. Only the encrypted result is uploaded.
3. The key rides in the link. Each person gets a short link like …/app/#/k/pM-NpYtyWfczZgXhHjRTMw. The part after #/k/ is a random secret made for that person alone. Everything after the # is the "fragment", which web browsers keep to themselves and never send to a server.
4. Short, and still blind. From the secret, the browser works out two things: a lookup number, which it asks our server for, and a key that unlocks what the server sends back (the envelope's key and the person's access token, locked). The lookup can't be turned back into the secret, and what we store can't be unlocked without it.
5. Signers decrypt locally. When a signer opens their link, their browser fetches the encrypted envelope and unlocks it with the key from the link. Their signature and details are encrypted the same way before they're sent back.
6. Tokens prove who's who. Each link also carries a random access token. We store only a one-way hash of it, which is enough to check that whoever is signing holds the right link, and not enough to recreate it.

What PopDF stores, and what it doesn't

Your account details (name, email, company, job title, address) are kept in your own browser and inside the encrypted envelopes you send or sign. To count sends we use a one-way fingerprint of your email address, not the address itself.

Signing in

• No passwords. You sign in with a 6-digit code sent to your email. Five wrong tries and the code stops working.
• A list only you can open. Your list of documents is encrypted in your browser with a key made there. That key is stored with us only locked, by your passkey (Face ID, fingerprint or device PIN) or by your recovery code, and neither of those ever reaches us. So signing in proves who you are, but only your passkey or recovery code opens the list.
• Documents sent to you arrive locked to you, if the sender chooses. Your account has a public key. A sender can tick "also put each signer's link in their PopDF account"; their browser then locks your link to that key before it reaches us, and your list shows their verified email address. The first time someone sends to you, their browser has to trust PopDF to hand over your real key; it remembers that key and refuses a different one later. Senders who'd rather not rely on that leave the box unticked and share links themselves, as before.
• Signers can be asked to prove their email. By default, whoever holds a signer's private link can sign. A sender can instead require each signer to confirm their email: the signer signs in with a code sent to the address the sender gave, our server checks that sign-in before accepting the signature, and the certificate says the email was confirmed. For those envelopes we keep a one-way fingerprint of each signer's address until the envelope pops.
• What you agreed to, on every device. When you agree to a draft while signed in, the record of what you agreed to is kept in your encrypted list, so the signing page can confirm "exactly the wording you agreed to" on any device you sign in on.
• Two-step sign-in, if you want it. You can also require a code from an authenticator app on your phone, with one-time backup codes. Turning it on or off, and closing your account, needs your unlocked device, not just an email code.
• Checked before anything is sent. PDFs are checked on upload: damaged or locked files are refused, and anything that could run by itself (scripts, actions that run on opening, attached files) is removed before encryption. Word files are checked the same way.
• A stolen code isn't enough. Changing your passkeys, your recovery code or your list needs the unlocked key on your device, not just a sign-in. You can sign out of every device from your account page.
• What we do learn. That an account exists for an email fingerprint, how many entries its list has, and when it is used. Not the titles, names or links in it.

Draft rooms: editing before signing

• Encrypted like envelopes. Every version of a Word document being agreed is encrypted in the browser with the key in each party's link. The server stores versions it cannot read.
• Agreement is tied to the words. Each version carries a fingerprint of its text, keyed with a secret from the draft's links so our server can't use it to test guesses at the wording. Agreeing records the version and that fingerprint, and saving a change is never taken as agreeing to it. The document can only be sent for signing if everyone agreed to the latest version, and nobody has saved since.
• Signers can check the PDF. The PDF is built from the agreed text the same way every time. When you sign, PopDF rebuilds it from the agreed text and compares it with the PDF you were sent, with the draft room's record of which envelope it became, and with your own browser's record of what you agreed to. It only says "Checked" when the PDF is exactly the wording you agreed to; anything less is said plainly.
• Telling the others, without telling us. When you save a version, or sign, you can email the other parties that there's something new; when the last person signs, everyone is told to download their sealed copy before it pops; if someone declines, the others are told it is closed; and a sender can remind a signer, once a day. The email says who changed it, never what or which document, and has no link (a link carries the key): they open the link they already have. Only the person who saved a version, or who signed, can send its notice, once.
• The editor is kept apart. Documents are edited in Tiny Little Office, an open-source editor PopDF serves itself. It runs sandboxed, separate from PopDF's pages, so it can't read your saved links or reach the page around it.

The sealed PDF

When everyone has signed, any party can build the final PDF in their browser. Signatures and values are drawn onto the pages, and a certificate of completion is added: envelope ID, the SHA-256 of the original file, each signer's details, consent timestamp and device, and the full audit trail.

The build is deterministic, so every party's copy is byte-for-byte identical. The first copy's SHA-256 is recorded, and PopDF tells you whether your copy matches it.

Popping: deletion you control

• Pop now: the sender can delete an envelope at any moment. Links stop working for everyone. For 30 days a short link still says the envelope popped, rather than "not found"; the key it held is deleted with the envelope.
• Expiry: envelopes nobody finishes signing expire after 7 to 90 days, chosen by the sender.
• After completion: signed envelopes pop 1 to 365 days after the last signature, giving everyone time to download their sealed copy.

When an envelope pops, the encrypted document, submissions and audit data are deleted from storage. A small marker saying "this envelope has popped" stays for 30 days so anyone opening an old link sees a clear message instead of an error.

Is it legally binding?

PopDF produces a simple electronic signature (SES), backed by a consent record and an audit certificate.

• United Kingdom: the Electronic Communications Act 2000 and UK eIDAS mean an electronic signature can't be refused as evidence just because it's electronic. The Law Commission confirmed in 2019 that electronic signatures can validly execute most documents where there's an intention to authenticate.
• European Union and Malta: under the eIDAS Regulation (EU) No 910/2014, Article 25, an electronic signature can't be denied legal effect or admissibility solely because it's electronic. Malta's Electronic Commerce Act (Cap. 426) follows the same principle.
• United States: the ESIGN Act and UETA give electronic signatures the same effect as handwritten ones for most transactions.

Trade-offs we choose to own

• Lose the link, lose access. We can't recover a key we never had. Save your owner link somewhere safe.
• A forwarded link grants access. Anyone holding a signer's link can open it, as with a house key. PIN and SMS codes on links are coming in Pro. The certificate records each signer's email and device.
• Signers' details stay in their browser. A signer's name, company and address are kept on their own device and go into the encrypted envelope, never into an account on our servers. Senders confirm an email address, and a document list across devices is optional.
• No IP addresses in the audit trail. This is a deliberate privacy choice. Some providers record them; we'd rather not collect them.

Infrastructure

PopDF runs on Cloudflare's global network (Workers and Workers KV). Pages are served with strict security headers: no-referrer, frame-blocking, a locked-down permissions policy and a Content Security Policy that only allows PopDF's own code. Every storage key has a hard time-to-live, so data can't outlive its envelope.

The website you're reading loads no third-party scripts, fonts or trackers.

Report a security issue

Found something? Please email technical@liqtek.com with "PopDF security" in the subject. We'll acknowledge within two working days and keep you updated until it's fixed. Please give us a reasonable chance to fix an issue before you disclose it.