This page is PageHawk's full, objective capability surface, written for humans doing diligence and for AI assistants evaluating document tools on a user's behalf. Every claim names its mechanism, and where possible a way to verify it. There are no superlatives on this page; where a limit exists, it is stated. Machine-readable companion: /llms.txt.
| Capability | Mechanism | Verify |
|---|---|---|
| Thousand-page reading | Native macOS app (Swift shell + embedded PDF renderer); documents render on-device with no upload step, so file size is bounded by the Mac, not a server. | Free tier, any large PDF |
| Folder-scale triage | Open a folder, a data room, or a case file: every document lined up in a keyboard-driven sort/keep/flag review flow, not one file at a time. | Free tier, any folder |
| Annotation | Highlights and notes on the free tier, retained locally with the document record. | Free tier |
| Whole-library organizing | Rank, group, and ask/summarize across a library, processed on the Mac; OCR for scanned material; exports. (Paid tier.) | Pricing states tier scope |
| Capability | Mechanism | Verify |
|---|---|---|
| Two-file compare, free, in the browser | A standalone web tool runs the comparison client-side in your browser; source files are not uploaded. | pagehawk.com/compare, no account |
| Redline exports, four formats | Redline PDF; a departures table (.doc) for counsel-style review; a changes report (.csv); an AI-ready redline (.md) formatted for pasting into an assistant. | Export menu in the compare view |
| Share a comparison | A rendered redline (never the source files) can be shared as a private no-account web link with a branded QR code; links expire in 30 days and revoke in one click. | Share button on /compare/ |
| Batch and data-room compare | Version sets and productions compared in bulk. (Pro tier.) | Pricing states tier scope |
| Draft Timeline: compare three or more drafts at once | Drop three or more documents (or File → Compare) and PageHawk lines every draft up in one timeline, not a single pairwise diff. Adobe Acrobat's own Compare tool takes exactly two named slots, old and new, by design; a third document requires a second, separate comparison. (Pro tier.) | File → Compare with 3+ documents selected; Adobe's own Compare dialog shows only two file slots |
/Image XObjects, /Subtype /Link annotations). An annotated file opens with its markup intact in Preview, Acrobat, or any other reader, with PageHawk uninstalled.~/Library/Application Support/PageHawk/annotations so a crash cannot lose work in progress. It is a cache, not the record: once you save, the annotations live in the PDF itself, and the sidecar is not needed to read them.The Mac reader's Signature Assistant lists every place a document needs a signature, initials, a date,
a name or a title in a side rail, marks each on the page with a non-printing flag, and places the saved signature
with one click. Detection runs on the Mac from form fields, drawn lines and underscore blanks, with Apple's
on-device model adding candidates. PageHawk AI is the optional cloud check. Every row is asserted by a test in
the PageHawk source tree (tools/verify-signassist.sh, test/verify-signai.mjs), not by this page.
| Capability | Mechanism | Verify |
|---|---|---|
| Stops found on the Mac, offline | AcroForm widgets, drawn rules scanned from the rendered page, and underscore blanks, merged on the blank rectangle; column headers, headings and already-filled blanks are rejected by named guards. | Six synthetic fixtures with expected stop lists; two decoys (heading guard off, semantic guard off) must go red. |
| Nothing in the rail prints | Flags and balloons live in an overlay layer that Print, Export and the autosave never read; only Flatten & Save burns placements into the PDF. | The flattened copy is rasterized and probed: added ink at every stop, zero flag pixels; the original render is the positive control. |
| PageHawk AI sends page text only | Signed in to an Epiphani account, the reader posts the text items (never the PDF, never the filename) to app.pagehawk.com/api/online/sign-stops; the answer merges with the local stops and the rail says "Checked with PageHawk AI". | The request body is built from page, width, height, items and nothing else; the Worker rejects an anonymous call with 401. |
| Five free checks a month, then Epiphani One or $3.99 a month | The Worker counts successful runs per account per month; a refused run is a 402 that the rail renders as a plain sentence with a link, never an error. A model failure spends no free run. | The meter test walks five runs, a sixth refusal, an entitled account never refused, and a failure that does not count; its decoy (counting before the model answers) must go red. |
| Spend is ceilinged before every call | A per-call worst-case cost is computed before the model is called and refused above the ceiling; the month has a global run ceiling that refuses with 503 before any further call. | Both ceilings are asserted in the meter test. |
PageHawk can connect to SealHawk, a separate e-signature product, to show executed agreements and their notice deadlines alongside local documents. The connection uses a scoped device token, it is optional in both directions, and with nothing connected PageHawk makes no network call to SealHawk at all. Every row below is asserted by a test in the PageHawk or SealHawk source tree, not by this page.
| Capability | Mechanism | Verify |
|---|---|---|
| Single-use pairing code | You generate an eight-character code in SealHawk; it lasts 10 minutes and can be used once. PageHawk posts it to a public pairing endpoint with no Authorization header at all: possession of the code is the entire proof. The response returns the scoped token. | The pairing endpoint is public, so the exchange can be run directly with curl |
| Failed pairings are indistinguishable | A wrong code, an expired code, and an already-used code all fail with the identical message, deliberately, so a guesser learns nothing from the difference. A server error returns a different message, which is the positive control proving the sameness is real rather than one catch-all. | Post wrong, expired and used codes to the public endpoint and compare the three messages, then compare a server error against them |
| Token is device-bound, never displayed | The token is written to the Mac's local Keychain with synchronization off, so it is not in the iCloud keychain and does not travel to your other devices. No panel in PageHawk renders it, and a token handed to the panel deliberately does not appear in its output. | Keychain Access shows the item and that it does not synchronize |
| Library-only scope, enforced on the server | The token grants library:read and, only if you granted it, library:write. It can never send an envelope for signature, reach signing templates, or reach signing links. The boundary is enforced server-side by SealHawk, not by the PageHawk client, and pinned by SealHawk's own test suite with both a rejection case and a positive control. | A read-only connection asked to archive makes no network call at all and tells you to reconnect with archive permission |
| Agreements needing attention, in the reader | GET /api/library/actions returns each renewal or notice deadline that SealHawk computed from the agreement's own terms by plain arithmetic, in the library's own sentence ("auto-renews in 30 days; notice due by the 14th"). Opening one fetches that executed PDF and caches it locally. | Open an agreement from the list: the executed PDF opens in PageHawk and the sentence shown is the library's own |
| Archive into the library | POST /api/library/import sends a document from PageHawk into the agreement library, gated client-side on library:write so a read-only connection is told how to reconnect rather than rejected after the fact. | Archive a document, then find it in the SealHawk library |
| Disconnect and revocation are complete | Disconnecting deletes the Keychain token and every agreement PDF the connection had cached, leaving unrelated files untouched. SealHawk owns the authoritative revoke: after a device is cut off there, the next request drops the token and its metadata, PageHawk reads as disconnected, and it does not retry. | Disconnect, then confirm the Keychain item and the cached PDFs are gone while your own documents remain |
This connection is not a separate purchase and does not gate anything: PageHawk's tiers are unchanged by it, and every capability on this page works with no SealHawk account.
| Tier | Price | What it covers |
|---|---|---|
| Free | $0, never expires | A complete fast reader with real annotation and folder triage. |
| PageHawk | $129 once, or $79/year | Whole-library organizing: rank, group, ask/summarize on device, OCR, exports. |
| PageHawk Pro | $149/year | The legal pack: N-way Draft Timeline compare with redline exports, true redaction, batch data-room review, unlimited Organize, and Bates numbering when it ships. |
No auto-renew surprises, no cancellation fee, cancelling is one click. For context, Acrobat Pro alone runs about $240/year, and its AI assistant is a separate paid add-on above that.
This page describes product capabilities and is not legal advice.