Your file stays in your browser
When you open a document, Penmark reads it with your browser’s own file APIs. Pages are rendered by PDF.js running in a Web Worker on your device. Form values, placed fields and signatures are applied by pdf-lib, also on your device. The finished PDF is created in memory and handed to your browser’s download manager. At no point is the document sent over the network.
What is stored, and where
- Your documents and their progress are saved in your browser’s IndexedDB storage, so you can close the tab and come back.
- Saved signatures and initials are stored the same way, as images.
- Your fill-once details (name, email and so on) are kept in local storage.
- Deleting a document in Penmark removes it from this storage. Clearing your browser’s site data removes everything.
Your account
An account holds your name, email and plan — nothing else. When you download, Penmark asks our server one question: may this account download? The file itself is still built on your device. Payments are handled by Paystack; we never see card or Mobile Money details.
Tamper evidence
The optional audit certificate records the completion time and a SHA-256 fingerprint of the original file you opened. Anyone can re-hash the original with standard tools to confirm it is the exact document that was signed.
Legal standing
Penmark creates simple electronic signatures, which are recognised for most agreements under the US ESIGN Act and UETA, and the EU eIDAS regulation. Some documents — wills, certain real-estate and court filings — can require a qualified signature, a witness or a notary. If in doubt, ask the person who sent you the document.
Reporting a vulnerability
Email [email protected]. We respond to every report.