How we made PDF contracts resistant to scraping

The task

Our B2B portal had to generate an invoice and a contract automatically when an order is placed. There was also a security requirement: the director's stamp and signature must not be easy to lift out of the PDF as plain images.

Choosing the tool: PDFKit

We dropped HTML-to-PDF conversion (Puppeteer, wkhtmltopdf) because it is slow and eats a lot of RAM on the server. We chose pdfkit — a low-level library that draws a vector PDF directly, without a browser in the middle.

Protecting the graphics

To make signature scraping harder, we draw the stamp and signature PNGs on the bottom layer as a background and put the document text on top. That removes the easy "right click, save image" path. An invisible watermark can be added on top of that as an extra layer of noise.

Cyrillic

By default PDFKit uses standard fonts with no Cyrillic support, and documents came out with blank characters. We baked Roboto TTF files into the Docker image and registered them programmatically before generating a document — no dependency on fonts installed on the host.

What this approach gives the business

Documents are generated in milliseconds, no headless browser has to be kept alive, and the layout is deterministic across environments. For a portal that issues hundreds of invoices a day, that is the difference between a background job and a server that constantly runs out of memory.