Document tools that never touch a server. Licensed for your business.

GhostX is a family of document tools — true redaction, e-signatures, compliance scanning, the full PDF toolkit — where every file is processed entirely in the user’s browser. License the engine to embed it in your product or deploy it across your organization.

Most “secure document” vendors process your files on their infrastructure and promise not to look. That promise has to be re-earned for every file, forever, with encryption at rest, access controls, audit logs, retention policy, and a breach-response plan for data you handed them in the first place.

GhostX takes a different position: the file never leaves the device. The engines are WebAssembly running inside the browser tab, so in the single-user flows there is no upload endpoint at all — no vendor-side copy to protect, because no vendor-side copy exists. “Bytes never touch a server” isn’t a marketing line here; it’s an architecture you can verify in your browser’s network tab in about a minute.

For teams that live under HIPAA, GLBA, FOIA, or client confidentiality obligations, that flips the usual vendor conversation. The question stops being “who else can see my files on your servers?” and becomes “what servers?”

What you can license

E-signatures with a tamper-evident audit trail

Solo or multi-party signing, every signed PDF carries an appended audit certificate and a SHA-256 hash anyone can re-verify — no account required of your counterparties.

True redaction with on-device PII detection

The text under the box is destroyed, not covered — and an AI model that runs on the reader’s own device flags names, SSNs, cards, and IBANs humans miss. Audio and video can be muted the same way.

Compliance X-ray for hidden data

Scan any file for GPS coordinates, author names, revision history, embedded attachments, and spoken PII — then scrub, mute, or redact it in one pass, on-device.

The full PDF toolkit

Merge, split, compress, convert, watermark, page numbers, unlock, metadata scrub — the whole family runs as WebAssembly inside the browser tab.

Proof, not promises

Redaction is where “privacy-first” claims go to die, so we tested instead of claiming. In our published study, four of the six mainstream free PDF redaction tools we examined left the “redacted” content recoverable or leaked sensitive document metadata — including a Social Security Number still sitting in an editable form field, and patient names in file metadata, after “redaction.”

GhostRedact destroys the content — the text under the box is removed from the file, not painted over — and a verification flow lets anyone check what is actually in the output. On our own test document it came back clean on every leak vector. The method, the corpus, and the scanner are public.

Read the study: 4 free redaction tools, tested and leaked

Two ways to work with us

Embed & white-label

Put the tools behind your own brand, inside your product — client portals, onboarding flows, case-management systems. Your users never learn a second vendor exists, and their files never reach your backend either.

Organizational deployment

Your compliance, legal, and operations teams use the hosted tools directly. Everything works exactly as it does publicly — free-tier simplicity, no data pipeline to review — with support, custom detection rules, and terms built around your requirements.

Frequently asked questions

How can document tools run without a server?

The processing engines are WebAssembly and JavaScript compiled to run inside the visitor’s browser tab: PDF parsing, rendering, redaction, signature generation, and the PII-detection model all execute on the user’s own CPU. In the single-user flows there is no upload endpoint at all — you can open the browser’s DevTools network tab, run every tool, and watch zero document bytes leave the device.

Does client-side processing actually help with HIPAA or PII obligations?

It changes the mechanics rather than the paperwork: if a file is never transmitted, there are no file bytes on a vendor’s server to encrypt, retain, breach, or subpoena. We can’t give legal advice, but the data-handling surface of “the file never left the device” is zero — which is why the same claim, made honestly, is the strongest line in a compliance conversation.

What about multi-party signing — where do those files go?

Multi-signer documents are end-to-end encrypted with an AES-GCM-256 key that lives only in the share link’s fragment — the part of the URL browsers never transmit. Our servers coordinate signers and store ciphertext only; the plaintext is never uploaded by anyone, including us.

How does licensing work?

Per product and per organization — embedding scope, branding, and support are scoped in conversation rather than through a self-serve tier. Tell us about your use case through the contact form and we’ll come back with terms.

Is GhostX still free if we just use the public tools?

Yes. The public tools at ghostx.tools are free for everyone, including commercial use inside your organization — no accounts, no watermarks, no daily limits, no upgrade prompts. Licensing is for embedding the engine in your own product, white-labeling it under your brand, or getting support and custom work on top.

Tell us about your use case

Whether you’re embedding the engine in a product or rolling it out across a compliance team, the conversation starts the same way. The consumer tools stay free either way — that doesn’t change.

Use the “Business / licensing” topic so it routes to the right place.