Fill from spreadsheet takes one fillable PDF and a CSV or Excel file and writes a correctly named PDF per row, flattened if you like. Request signatures places fields per recipient, seals the document on your device and lets each signer sign on theirs, ending with an audit page and a trusted timestamp. Redact removes identifiers from a page rather than covering them. Flatten locks completed forms, Add page numbers finishes a policy pack, and Protect encrypts a payslip before it is sent. Teams shares the same presets across the department.
The jobs, and the tool for each
Generate offer letters from a spreadsheet
One PDF per row, fields mapped to columns automatically, file names from tokens such as the candidate’s name, optional flattening. The spreadsheet of salaries and addresses is read once in the browser and never uploaded.
Fill PDF from spreadsheet →Get a contract signed by a new hire
The contract is sealed in your browser; the signer opens a link on their own device with no account; the broker holds only ciphertext and hashes. Completion appends a hash-chained audit page and an RFC 3161 timestamp.
Request PDF signatures →Redact a candidate’s details before a panel review
Names, addresses and dates of birth are removed from the page by re-rendering it, not hidden under a box. Search lists and PII suggestions find every occurrence; a redaction log records what was done.
Redact PDF →Flatten a completed form so it cannot be edited
A signed acknowledgment or a completed onboarding form becomes permanent page content, with review comments stripped. Flattening is not encryption — add Protect for a copy leaving the company.
Flatten PDF →Number a handbook or policy pack
Position, format and starting number are previewed live and written as real text, with the cover page skipped. Merge first to combine policies into one pack with an outline.
Add Page Numbers →Encrypt a payslip or contract before sending it
Real PDF encryption applied in the browser: the file refuses to open in any viewer without the password. Send the password by a separate channel; nobody, including Bindery, can recover it.
Protect PDF →What leaves your device
Personnel documents are processed in the browser tab and never uploaded; Bindery has no server copy of a contract, a CV or a payslip and no document-processing API to receive one. The optional account stores an email address and sign-in identity, plan status, a minimal daily job count and any synced Pro recipes and presets — workflow settings, not the files they are applied to. Signature requests and Secure handoff links are the two features that use Bindery’s storage: they hold packages sealed on the device with AES-256, hashed link tokens, field positions and a log of times and SHA-256 hashes, never the key or the document. Signing links are not emailed by Bindery; you send them yourself. Teams adds shared presets and a count-only view of jobs per member with no file names, tools or sizes, plus an audit log of admin actions. None of this is a certification of compliance with employment or data-protection law; Bindery removes the upload and leaves your own obligations in place.
The full list of services, retention periods and subprocessors is on the security page; the verify page shows how to confirm the no-upload claim in your own browser.
Questions people ask
How many signature requests can I send?
Three per 30 days on the free plan; Pro lifts the cap. Each request can include several recipients who sign in any order or one after another, and signers need no account. Bindery does not email the links — you send each one through a channel you trust.
Can Fill from spreadsheet handle a few hundred rows?
Yes. There is no imposed row limit; each copy is filled on your device one after another and you can cancel at any point. The practical bound is your machine’s memory for the ZIP that packs the results. Checkboxes tick on yes, true, 1 or x; dropdowns select the option whose name matches the cell.
Is redaction safe enough for a candidate’s personal data?
The mechanism removes the text: redacted pages are re-rendered as images with the boxes burned in, so nothing under a box can be copied or searched, and untouched pages keep their text. Strip metadata afterwards and run the copy-and-search test before sharing; deciding what counts as personal data remains your call.