One Document. One Local Pipeline.
The architecture starts with a choice you make and ends with a file you inspect.
Choose A File.
You explicitly select a PDF in the Witalias workspace. The original opens in the local workspace on your device. Witalias does not intercept unrelated uploads.
Process Locally.
A dedicated worker loads the packaged WebAssembly PDF engine, extracts text and coordinates, and creates suggestions. The UI shows your file locally as rendered page images.
Review.
You choose treatments, add exact terms or draw removal areas. There is no remote model call.
Create A Copy.
Selected underlying content is redacted, replacement labels are placed, and pages are written into a fresh PDF. Document-level metadata and embedded attachments are discarded.
Check And Download.
The engine reopens the output and checks selected text, retained labels, page count and dimensions. You inspect the actual output and choose whether to download it.
The Document’s Journey.
An Extension With A Small Footprint.
The extension has one purpose: preparing a private PDF copy. It requests only the witalias.com host permission for account and allowance requests, reads no other tabs and injects no content scripts. No optional permissions are requested. A toolbar popup opens an extension-owned workspace tab.
Scripts, WebAssembly and fonts ship inside the package. The content security policy keeps scripts local and permits network requests only to packaged resources and https://witalias.com. WebAssembly compilation is enabled for the bundled engine; remote JavaScript is not permitted.
A Session, Not A Document Archive.
The active file, findings, replacement mapping and output live in application and worker memory. Clear session terminates the worker, revokes preview URLs and drops the active application state. Closing the workspace ends that session.
We cannot promise secure erasure from browser internals, operating-system swap, crash dumps or device backups. Downloaded files remain where you save them. Protect your device and remove local downloads separately when appropriate.
Fail Closed When The Copy Cannot Be Checked.
The app rejects unsupported files instead of pretending they were protected. Limits cover file size, page count, page geometry and text volume. Long-running worker operations are timed out and terminated.
An export is blocked if selected original text remains in extraction, a required label disappears, a label cannot fit legibly, attachments remain or page dimensions change. Overlapping or invalid selections are checked before redaction.
A fresh document discards original PDF document/page metadata, actions, links, annotations and embedded files. Image-internal metadata and identities visible in images require separate review; automatic OCR and image sanitisation are not included.
Report A Security Issue Responsibly.
If you suspect that selected data survives an export, stop sharing that file. Use a synthetic example or a minimal description first; do not send private originals or passwords. Include the app version, Chrome version, operating system and reproducible steps.
Use the contact page to report security issues. We do not advertise a guaranteed response time or bug bounty.