NextPDF Enterprise · Edition

NextPDF Enterprise capabilities

At a glance

NextPDF Enterprise is the upper-tier commercial edition of NextPDF. It includes everything in NextPDF Pro and Core, then adds long-term archival signing, hardware-security-module key custody, signature and trusted-list validation, compliance evidence, content sanitization, privacy controls, and the operational tooling that regulated, high-scale deployments depend on.

Enterprise builds on nextpdf/core and nextpdf/pro. Where a capability extends a public contract Core declares, your call site is unchanged across the editions, so moving from Pro to Enterprise is an upgrade, not a migration. Enterprise-native capabilities (for example the long-term signature producer, validation, and privacy) are called through the NextPDF\Enterprise namespace directly. Pro and Enterprise ship together in the Premium package; a signed license selects which capabilities run.

Use this page as the map for the Enterprise edition. Start with the quickstart, then jump to the capability cluster for the job in front of you. Each capability page carries the conceptual overview, public API surface, and edge behavior; where a Deep Reference page exists, it carries the full type-level detail (newer modules may ship the capability page first).

Start here

New to Enterprise? Work through these in order.

Install and authenticate. The quickstart installs the package with composer require nextpdf/enterprise, activates your license envelope, and confirms the resolved entitlement.
Get two first results. The same quickstart verifies an existing signed PDF with the AdES validation engine, then upgrades a signed document to PAdES B-LT.
Understand licensing. License activation covers evaluation mode, grace periods, and the perpetual-fallback guarantee that keeps an expired paid license running.

Capability map

Capabilities are grouped by the job they do. Each entry links the capability page first and its Deep Reference second.

Trust & signatures

Signature — PAdES B-LT and B-LTA structures: DSS, validation-related information, and document timestamps over the Core CMS signer. Deep Reference
Signature verification — verify CMS and RFC 3161 tokens, validate the TSA certificate at genTime, and check archival timestamp coverage. Deep Reference
Batch signature validation — validate signatures across many PDFs in one call; unavailable revocation evidence maps to Indeterminate, never Valid.
Trusted lists (TSL) — fetch, authenticate, and policy-enforce ETSI TS 119 612 trusted lists into fail-closed trust-anchor bundles. Deep Reference
ASiC trust binding — bind an ASiC container signature’s certificate to trusted-list anchors and return an evidence-carrying verdict.
eIDAS assurance levels — map EU trusted-list evidence to eIDAS levels (low, substantial, high) with auditable, PII-redacted assertions.
HSM signing (PKCS#11) — sign with a key that never leaves a PKCS#11 hardware security module through the Core HSM signer contract. Deep Reference
FIPS 140 mode — restrict cryptography to FIPS-approved options, self-test at runtime, and fail closed on mismatch. Deep Reference
Certificate Transparency — represent a signing certificate’s SCT posture and require CT-logged certificates before signing. Deep Reference
Post-quantum signing (preview) — opt-in, default-off preview: HSM-delegated ML-DSA and SLH-DSA signing through PKCS#11. Not GA, not AdES. Deep Reference

Validate & archive

Validation — in-process, read-only structural policy checks for PDF/A-4, PAdES, LTV, ZUGFeRD, and regulatory retention profiles. Deep Reference
Compliance — route a finished PDF to an external validator sidecar (veraPDF, EU DSS, Mustang) and read a structured result. Deep Reference
Archive — maintain long-term archival validity: DSS and VRI structure, LTV health checks, and the document-timestamp loop. Deep Reference
Invoice — produce ZUGFeRD, Factur-X, and Peppol-UBL hybrid invoices and validate XML against EN 16931 and Schematron. Deep Reference
Document e-filing — sanitize, linearize, and size-split PDFs into delivery artifacts for e-court and government filing by jurisdiction. Deep Reference
Evidence — assemble validation findings into a sealed, deterministic, optionally RFC 3161 timestamped package and track regressions. Deep Reference

Content security & privacy

Content Disarm and Reconstruction (CDR) — admit, scan, and rebuild an untrusted PDF to strip JavaScript, launch actions, and embedded files. Deep Reference
Steganography and watermarking — embed an encrypted per-recipient leak-tracing marker into text kerning using authenticated encryption. Deep Reference
Privacy — detect configured PII patterns and apply redaction, suppression, or reversible pseudonymization with an audit trail. Deep Reference
Forensics — read a PDF’s incremental-update history and report per-revision and per-object structural changes, read-only. Deep Reference
Intelligence — type raw key-value and table data into schema-validated structures and produce searchable PDFs via OCR. Deep Reference
Security — the combined PKCS#11 hardware-token signing path and FIPS-mode cryptographic policy over Core. Deep Reference

Platform & operations

Accelerator — a GPU sidecar for embeddings and a KMS provider factory for collection-level data-encryption keys. Deep Reference
Output pipeline — coordinate large-scale batch execution of Pro output-pipeline manifests with bounded concurrency and an optional compliance handoff. Deep Reference
Stream — run cross-host document-job streams to durable terminal outcomes with atomic object-storage commits and a durable event outbox.
Webhook — deliver job events to per-tenant endpoints with HMAC-SHA256 signing, exponential-backoff retry, and a dead-letter queue. Deep Reference
Metering — buffer and batch orchestration-level usage metering with multi-backend fan-out, retry, and failure isolation. Deep Reference
Billing — track compute-unit usage against a plan quota and apply hard-stop, soft-stop, or budget-alert overage policies. Deep Reference
SaaS — multi-tenant building blocks: tenant context, checksummed API keys, pre-request quota checks, and pull-based metering sync. Deep Reference
Licensing — resolve a license into a runtime entitlement, with grace-period and perpetual-fallback behavior and optional online activation. Deep Reference
Branding — the evaluation-branding subsystem: evaluation watermark and branding mode, driven entirely by the license. Deep Reference
Release — model release artifacts, build profiles, distribution channels, access boundaries, and a derived publishing plan. Deep Reference
Contracts — the injectable TSA-client contract Enterprise components bind against, plus the Core timestamp-client adapter. Deep Reference
Common — shared, resolution-independent primitives across Enterprise modules, starting with a normalized bounding box. Deep Reference
PHPStan — a custom PHPStan rule that flags edition import-boundary violations across the Core, Pro, and Enterprise namespaces. Deep Reference
MCP tools — eleven Model Context Protocol tools for compliance, forensics, LTV health, chunking, and RAG through NextPDF Connect. Deep Reference

Editions and licensing

NextPDF ships as four distributions: open-source NextPDF, open-source NextPDF Server, NextPDF Pro, and NextPDF Enterprise. Pro and Enterprise are the two commercial editions and ship together in the Premium package; the signed license envelope names the active edition. Editions are cumulative: Enterprise includes Pro, and Pro includes Core.

Evaluation output carries a watermark that a paid license removes with no code change. A paid license that reaches the end of its term keeps working: after a grace window it enters perpetual fallback, where the installed edition keeps running and only updates and support stop. The feature matrix traces each capability to source, and License activation covers authentication, activation, and the offline and online license channels.