How a scanned PDF is corrected and checked

The steps, as the app shows them

When you first open CECO PDF, it shows one correction being made, start to finish, in six steps:

1. A page with a mistake on it. Open a PDF of your own, or press “Try a sample document” to try one the app provides.
2. Click the word you want to change. Or drag a box around the words. On a touch screen, tap the word, or press “Select an area” and run a finger over the words.
3. It comes back to you filled in. Fix it. What the page says now is filled in for you; type what it should say.
4. Apply the correction. Nothing on the page changes until you do.
5. Checked: nothing outside the edited word moved. Before the result is shown, the page is compared with the original, as the check below describes.
6. Download the corrected PDF. What each plan lets you download is on the pricing page.

On a touch screen the demo has seven steps: “Click” becomes “Tap”, and a step a mouse does not need comes second: “Pinch with two fingers to zoom in, and move with two.”

How the new words reach the page

A PDF holds its words in one of two ways. Some have a real text layer: the letters are text, and can be selected and searched. A scan is a picture of paper, and its words are ink in that picture. CECO PDF corrects both, and the result says which of four things it did:

• Typed. The correction is typed into the page as text, so it stays selectable and searchable, and no part of the page is redrawn.
• Moved, not redrawn. Only marks already on the page were moved. Nothing was invented, so the corrected words are the document's own ink, in its own print.
• Drawn. The page did not hold the ink the new words need, so they were drawn to match the type beside them, with their blur, grain and ink colour taken from what surrounds the selection. They are not the document's own ink, and someone comparing the patch closely with the rest of the page could tell. On a page that also carries real text, drawn words become part of the picture: they can no longer be selected or searched, and the result says so.
• Paragraph re-set. The replacement needed the paragraph laid out again, so words you did not correct move on the page.

The check: 300 dpi, and nothing outside

Every correction declares the region of the page it may change. Once it is made, the page is rendered before and after at 300 dots per inch, and the two pictures are compared pixel by pixel.

The correction is verified only if every pixel that changed lies inside that region, so the count of changed pixels outside it is 0 on every page, and every guard passed: the text is where it was measured to be, the edit kept to its own line, and the letters came through whole. The result shows the words before and after, then that count, as outside 0 px.

Until the check passes, the corrected file cannot be downloaded. If it fails, the result says so and offers to undo the correction. A document that changes after it was verified has to be verified again before it can be downloaded.

You can look for yourself, too. “Look closely” shows the corrected region magnified, before and after, and holding B on the page puts the original back in its place. Inspection is at whole-number magnification with no smoothing, so every pixel is shown as it was rendered, only larger.

The same rules, with the fields the API returns for each check, are in the verification model.

What it refuses, and why

A correction that cannot be made well is refused rather than made badly. The refusal says what happened and why it matters and, where there is something to try, what to try next. Your document stays as it was. Among the reasons:

• The selection missed the words. Everything is measured from what the selection encloses, so a box on the margin, or between two lines, measures the wrong thing.
• The word appears more than once, and the reading is not certain which one you mean. Correcting the wrong one would produce a document that verifies perfectly and says the wrong thing. There is no replace-all, either: each place a word appears is its own correction, made and checked on its own.
• A stamp, a rule or a fold crosses the words. Moving ink means cutting the line at a column free of ink, and any cut here would shear the mark.
• The paper behind the words cannot be reproduced. Filling the gap they leave would mean inventing paper rather than matching it.
• The replacement is too long for its line. Setting it in full would re-break the paragraph and move lines nobody edited.
• Drawn letters would not match the page. They would come out sharper than the scan around them, or the typeface could not be identified with confidence, and letters in the wrong face are the wrong shape.

When a refusal names a limit of the tool rather than of the selection, you can choose to send us that part of the page, so later versions can be measured against it. Nothing is sent unless you press the button that sends it, and the privacy notice says exactly what goes, and for how long.

The record inside the file

A corrected PDF carries a provenance record: every correction, where on the page it was made and how, as the engine wrote it. It travels inside the file as an attachment named provenance.json, and names the file as a corrected copy.

That copy is a claim, not proof. Anyone holding a PDF can strip or rewrite anything inside it, this record included, so the evidence is what the service keeps. There, every upload, correction, undo, export and download is written to an append-only record in which each entry carries the hash of the one before, so the chain can be recomputed to show where it breaks, if anywhere.

Every correction in that record carries an attestation, a statement of authority in these words: “I confirm I am authorised to alter this document. I understand that if it has already been issued or served, the appropriate route is a formal correction or a corrected re-issue, not a retouch. I accept responsibility for this change.” With a Business plan, the whole record can be exported as a file you can hand over.

When a page carries marks of having been issued (a protocol number, a registry date, or stamps), the app says so, and that for a document already issued or served, the clean route is a corrected re-issue rather than a retouch.

Certificates, and checking one

With a Business plan, you can issue a verification certificate for a corrected document. It holds the document's SHA-256 hash as uploaded and as corrected, every correction with its measurement, and the head of the record at the moment it was issued, all signed with Ed25519.

Whoever you hand it to can check it without an account, at the certificate check: by the certificate's id, or by uploading the certificate PDF, which is compared with what was issued and not kept. The public key is published at /.well-known/ceco-certificate-key, so the signature can be checked without CECO PDF at all.

The limits

What each plan accepts, as the code that enforces it reports:

• Free: files up to 5 MB and 50 pages; 10 corrections a day.
• 1 document: files up to 5 MB and 50 pages; unlimited corrections for 30 days after buying, then 10 a day.
• 10 documents: files up to 5 MB and 50 pages; unlimited corrections for 30 days after buying, then 10 a day.
• Personal: files up to 10 MB and 100 pages; no daily limit on corrections.
• Business: files up to 30 MB and 300 pages; no daily limit on corrections.

A file over its plan's limit is refused when it is uploaded, and the message names the limit. What each plan costs is on the pricing page.

What it is not

A verification is a statement about the image, made by the service about its own output: at 300 dpi, nothing outside the declared region changed. It does not say the corrected words are true, or that the document is accurate, lawful or acceptable to whoever receives it, and it is not evidence that anybody was entitled to make the change. A certificate is not a notarisation, a legal attestation or an invoice.

Correct only documents that are yours, or that you are entitled to alter. CECO PDF does not try to judge that, because no automated check can; it records instead, with the attestation in every correction and the record in the file. Using it to forge, falsify or misrepresent a document is a misuse of the service and, in most places, a criminal offence, and accounts doing so are closed. The terms say so, under “Who may alter a document”.