A signed PDF is rarely a casual file. It may be a rental agreement, a consent form, an employment contract or a loan document. It usually contains a full name, an address and often an ID number. Where that file goes while it is being signed matters as much as the signature itself.
This guide explains what can happen to a document on an upload-based signing website, what to check before using one, and what a signature on a PDF actually proves. It does not repeat the how-to steps, which are in how to sign a PDF on your phone and how to add a signature to a PDF without Adobe. For the legal side, see is an electronic signature on a PDF legally valid.
What happens when a signing site uploads your document
Most web signing services work in one of two ways. Some process the file in the browser, so the document stays on the device. Others send the PDF to a server, place the signature there and send back a signed copy. The second design is common, because a server can also manage workflows, reminders and several signers.
When the file is uploaded, the provider receives a full copy of the document. What it does next depends on its own terms. The copy may be deleted after the signing session, kept in an account until the user deletes it, or kept for a fixed number of months or years.
What data protection rules say about keeping documents
Data protection law gives a way to judge those practices. Under the UK GDPR, personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", and must be "kept in a form which permits identification of data subjects for no longer than is necessary" for those purposes. The UK Information Commissioner's Office states the storage limitation principle in plain terms: "You must not keep personal data for longer than you need it." It also says organisations need "a policy setting standard retention periods wherever possible". The EU GDPR contains the same principles, and its recital 39 says the storage period should be limited to a strict minimum.
For a reader, the practical point is that a reputable provider should be able to say how long it keeps uploaded documents, and why. A vague answer such as "as long as necessary" with no figure and no way to delete the file is a reason to look further. This is general information, not legal advice, and the rules that apply to a particular provider depend on where it operates.
Five checks before using a signing website
- Find the retention period. Open the privacy policy and look for a section on retention or storage. A clear figure, such as a number of days, and a stated way to delete documents earlier, is better than general wording. If the policy is silent about uploaded documents, treat that as unknown, not as safe.
- See whether an account is required. Some services need a sign-up before the first signature. An account means the provider holds an email address and an identity linked to every document. It also means documents may sit in a dashboard until deleted. Check whether guest signing exists and whether a document can be deleted from the account.
- Find out where the file is processed. The site should say whether the PDF is uploaded or handled in the browser. How to check if a PDF website uploads your files shows a method using the browser's network panel, and how on-device PDF tools work explains the design. A claim that a site is secure does not answer this question.
- Ask what record of the signing is kept. Some services produce an audit trail, which is a log of who signed, when and from which device or address. That record can be valuable if a signature is disputed later. It also means more personal data is held about the signer. A tool that only places an image on a page keeps no such record.
- Check who else receives the document. Policies often list sub-processors, such as hosting and storage companies, and the countries where data is held. Look for that list, and for a contact address for deletion requests.
Two different things called a signature
The word signature covers two technically different things, and the checks above matter differently for each.
- A signature image. A drawn, typed or uploaded picture of a signature, placed on the page. It is a simple electronic signature. In the EU's eIDAS Regulation an electronic signature is "data in electronic form which is attached to or logically associated with other data in electronic form" and which "is used by the signatory to sign". A picture of a handwritten name can meet that definition, but it does not by itself prove who placed it or whether the page changed afterwards.
- A certificate-based digital signature. A cryptographic signature tied to a certificate. NIST describes digital signatures as used "to detect unauthorized modifications to data and to authenticate the identity of the signatory". A PDF reader can show whether the file changed after signing. In eIDAS terms, an advanced electronic signature must be "uniquely linked to the signatory", "capable of identifying the signatory" and "linked to the data signed therewith in such a way that any subsequent change in the data is detectable". A qualified electronic signature adds a qualified certificate and a qualified signature creation device, and Article 25 gives it "the equivalent legal effect of a handwritten signature".
Article 25 also says an electronic signature cannot be refused legal effect solely because it is in electronic form or does not meet the requirements for qualified signatures. So an image signature is not worthless. It is a lighter kind of evidence, suited to everyday paperwork. If a contract, a filing or an authority names a required signature type, follow that, and ask the receiving organisation which it accepts.
Common mistakes
- Signing a document that contains more than the signer needs to share, such as a full ID scan attached as a page. Remove unneeded pages first.
- Assuming a free service is private because it does not ask for payment. The policy, not the price, tells you what happens to the file.
- Treating a signature picture as proof the document was not changed. Without a certificate, a later edit to the PDF would not be flagged.
- Sending a signed file by email without considering what else the PDF contains, such as author details in its metadata.
How to sign with DocPro
DocPro's Sign PDF works in the browser. The PDF is opened and written by code running on the device, and the file is not sent to a DocPro server for signing. Sign PDF is the one Pro feature in DocPro, alongside saved signatures. Every other DocPro tool is free with no account.
- Open Sign PDF and choose the PDF. A password-protected file asks for its password on the device.
- Under "1 · Choose a signature", press "Create new" and pick Draw, Type or Upload image. Tick "Save to my vault" only if the signature should be kept for next time.
- Under "2 · Place it", drag the signature to the right page and line, and resize it with the round handles.
- Under "3 · Save", press "Sign and download". This step asks for DocPro Pro. Setting up the file and the signature does not require an account.
The result is a new PDF. The tool states on the result card: "This is a picture of your signature placed on the page. It is not a certificate-based digital signature."
Saved signatures are kept in the browser's own storage on that device. The Signature vault says they are "Saved on this device only, in this browser. Nothing is uploaded. Clearing site data removes them." If the browser blocks storage, signatures last only until the tab closes. On a shared computer, delete saved signatures from the vault when finished. Downloading a signature as a PNG from the vault also needs Pro.
What DocPro cannot do
- It does not create certificate-based digital signatures, so there is no validity panel and no tamper detection in a PDF reader.
- It does not keep an audit trail or a record of who signed. If a workflow needs one, an identity-verified signing service or a qualified signature provider is the right tool.
- The web tool does not collect signatures from other people or send reminders.
- It does not prove who the signer is. It places an image.
After signing, Flatten can fix form fields and marks in place, and Protect PDF can add a password before the file is shared. Other signing and privacy tools are listed on the Sign PDF hub.
This is general information, not legal advice. For a high-stakes document, ask the organisation that will receive it, or a lawyer.
Frequently asked questions
Do online signing websites keep my documents?
Some do and some do not. It depends on whether the site uploads the file and on its retention policy. Read the privacy policy for a retention period and a way to delete documents. If neither is stated, treat the retention as unknown.
Is a signature image the same as a digital signature?
No. A signature image is a picture of a signature placed on the page. A certificate-based digital signature is cryptographic, ties the file to a certificate and lets a PDF reader detect later changes. Which one is needed depends on the document and the recipient.
Does DocPro upload my PDF when I sign it?
No. Sign PDF processes the file in the browser. Signing itself requires DocPro Pro, and the PDF is not part of the account check.
Where are my saved signatures stored?
In the browser's own storage on the device you used, not on a server. Clearing site data removes them, and they do not follow you to another browser or device.
Is Sign PDF free?
No. Sign PDF and saved signatures are the Pro features in DocPro. All other tools are free.