Premium edition

For security & compliance teams

At a glance

You are the reviewer who has to sign off on a PDF engine. This page states NextPDF’s security and compliance posture in the terms you will defend later: what maps to which standard, what is enforced fail-closed, and where the boundaries sit. NextPDF produces the structures a standard defines; an independent validator or receiving authority decides whether a specific file conforms. Every standards-backed claim below either carries a citation or links to the page that owns it.

Availability & licensing

This guide covers both commercial editions - NextPDF Pro (nextpdf/pro) and NextPDF Enterprise (nextpdf/enterprise); see the feature matrix for per-edition availability. Both activate with a license envelope; a deployment without the matching entitlement does not load that edition’s premium classes. Compare editions and get a license.

What you’re buying

In thirty seconds: a PHP 8.4 engine whose premium editions add the security stack regulated document workflows need. Signing follows the PAdES baseline profiles (B-B through B-LTA); a fail-closed verify-side reports in the ETSI EN 319 102-1 status taxonomy. Archival output targets PDF/A-4, e-invoicing follows EN 16931, and a FIPS-mode policy restricts crypto choices to an approved set with a power-on self-test. Evidence surfaces produce sealed, deterministic audit artifacts. The open core is Apache-2.0 and fully inspectable; the standards map is Compliance and conformance.

The questions we hear most

Is NextPDF certified against these standards?

No. NextPDF is built to produce the standards-mapped structures and evidence; that is a capability claim, not a verdict. A clean run from an independent validator is evidence of conformance for a specific file; a producer’s own markers never are (ISO 19005-4 §6.7.3). See the conformance section.

Will signatures produced here stand up under eIDAS?

NextPDF produces signatures conforming to the PAdES baseline profiles (ETSI EN 319 142-1). Under eIDAS, an electronic signature may not be denied legal effect solely because it is electronic (Regulation (EU) No 910/2014, Art. 25(1)), and a qualified signature carries the effect of a handwritten one (Art. 25(2)). The caveat: qualification and legal status come from the certificate, trust service, and jurisdiction — outside any library, ours included. Enterprise classifies EU trusted-list evidence into assurance levels with auditable reason codes — a classification, never a qualification grant (eIDAS assurance levels).

How does the verify-side behave?

Verification is evidence-based and fail-closed: an unsupported algorithm, a missing trust anchor, or an unprovable check is a rejection, never a silent pass. Outcomes use the EN 319 102-1 taxonomy — TOTAL-PASSED, TOTAL-FAILED, or INDETERMINATE — with no softer fourth state (Clause 3.1). The archival entry point your auditors will care about is NextPDF\Enterprise\Security\Validation\AdESValidationEngine::validateArchivalTimestampChain():

public function validateArchivalTimestampChain(
    string $pdfBytes,
    array $dssData = [],
    ?TrustAnchorStoreInterface $anchors = null,
): ValidationReport;

Throws or fails with: no exception on a bad chain — it returns a mapped INDETERMINATE or TOTAL_FAILED ValidationReport (structural defects map to a format failure). TOTAL_PASSED requires a complete, trust-anchored chain covering the file to its end-of-file marker; with no trust anchors configured, every chain is untrusted — never a pass. Full behavior: Signature verification.

Is NextPDF FIPS 140-3 validated?

No. FIPS 140-3 validation is conferred on cryptographic modules by the CMVP through accredited testing; NextPDF is not a validated module and makes no FIPS certification claim. Enterprise ships a FIPS-mode capability: strict and standard policy presets, a runtime guard asserting every hash, signature OID, and key strength before an operation runs, and a power-on known-answer self-test that fails closed and stays latched until process restart. The boot gate is one call:

public function assertOperational(): void

Throws or fails with: FipsModuleErrorStateException when any known-answer test failed or the process previously latched an error state; the runtime guard raises FipsViolationException on any disallowed choice. For a FIPS-compatible deployment claim, you supply the validated boundary — a FIPS-validated OpenSSL provider or HSM. Details: FIPS 140-2/3 policy and self-test and HSM and FIPS validation.

Does it phone home? Can we verify and air-gap what we deploy?

Per delivery channel, documented rather than discovered. The ionCube-encoded channel verifies its licence periodically online: roughly a 7-day check renewing an approximately 14-day lease. Offline past the lease, premium features pause and the engine falls back to the free Core — it does not crash — and they resume on reconnect. A check sends only a licence identifier and a salted fingerprint hash, never document content, a raw fingerprint, or an IP-address payload field. (As with any HTTPS request, the transport layer necessarily exposes a source IP to the licensing endpoint’s infrastructure - network metadata, not payload.) The signed-source channel verifies its licence locally, needs no periodic connectivity, and suits air-gapped deployments; a purely offline deployment sends nothing at all. Either way the failure mode is degradation to the open-source Core, never a brick (Two delivery channels).

For supply-chain review, the signed-source channel delivers readable PHP source, cryptographically signed so you can verify it is genuine and unmodified before use — the control OWASP describes as artifact signing with validation before use. The ionCube channel delivers encoded PHP run through the ionCube Loader; encoded builds are not source-reviewable - use the signed-source channel when pre-use source review or artifact signature verification is required. The readable source is released only after you sign the licence agreement in your account, and it remains PATEON’s confidential trade secret under the EULA — reading it is never permission to copy or redistribute it (Product licensing).

What about post-quantum and C2PA?

Both exist, and both are previews — default-off, fail-closed, and carrying no conformance claim. The post-quantum HSM signing surface (signPqs, reported by PqsCapabilityStatus) is a signing-only preview, opt-in behind a per-signer flag and a process env flag. The C2PA surface carries a caller-supplied manifest store both ways, while draft manifest synthesis sits behind a default-off flag; C2paCapabilityStatus hard-codes generallyAvailable and conformanceClaimed to false. Boundaries: PQC preview, C2PA preview.

How are vulnerabilities handled?

Through a published coordinated-disclosure policy: private intake, an RFC 9116 security.txt surface, triage-driven timelines, and a bounded embargo — aligned with ISO/IEC 29147 and ISO/IEC 30111, a process commitment, not a guarantee (Vulnerability disclosure policy).

What audit evidence can we actually produce?

Three surfaces. Evidence seals validation findings into an immutable package with a deterministic JSON form, a stable SHA-256 digest, and an optional RFC 3161 timestamp — WORM-ready, explicitly not a legal attestation (Evidence). Forensics reports the parsed incremental-update structure without certifying integrity (Forensics). Validation reports carry archivable per-check findings. Audit serialization redacts signer identity fields by default — GDPR data minimisation (Art. 5(1)(c)) applied to audit output (Data handling).

Requirements checklist

Your requirement	NextPDF can	Boundary	Grounding
PAdES signatures with long-term levels	Produce B-B, B-T, B-LT, B-LTA per ETSI EN 319 142-1 (Core/Pro: B-B and B-T; Enterprise adds B-LT and B-LTA)	Confer legal status; that depends on certificate, trust service, jurisdiction	eIDAS Art. 25(1)/(2); Compliance
Cryptographic signature verification	Verify CMS and RFC 3161 tokens fail-closed; report `TOTAL-PASSED` / `TOTAL-FAILED` / `INDETERMINATE`	Pass an unsupported algorithm or an un-anchored chain; no softer verdict exists	ETSI EN 319 102-1 Clause 3.1
PDF/A-4 archival output	Produce the structures the profile requires, with the identification schema declared	Self-certify conformance; a validation process outside the producer decides	ISO 19005-4 §6.7.3
EN 16931 e-invoicing	Produce and validate core-model instances; ZUGFeRD / Factur-X hybrid output	Act as a tax-authority validator; national extensions are out of scope	EN 16931-1 Scope; Pro compliance
FIPS 140-3 assurance	Enforce a FIPS-mode policy, runtime guard, and fail-closed power-on self-test	Be a validated module; you supply the CMVP-validated provider or HSM	FIPS 140-3 (CMVP); FIPS page
Air-gapped operation	Run fully offline on the signed-source channel, licence verified locally	Run the ionCube channel offline past its ~14-day lease; it pauses to Core	Delivery channels
Supply-chain verification of the artifact	Deliver signature-verified readable source you can review before use	Make the encoded ionCube artifact source-reviewable; choose the channel to match	OWASP Cheat Sheet Series (artifact integrity)
Privacy-safe audit trails	Redact signer PII from serialized audit output by default	Make lawful-basis or data-residency decisions for your deployment	GDPR Art. 5(1)(c); Data handling
PDF/UA accessibility	Report PDF/UA-2 language-tag events fail-closed, with machine-readable reasons	Claim full PDF/UA conformance checking or certify accessibility	Pro compliance
Post-quantum signing today	Preview only: HSM-delegated ML-DSA / SLH-DSA behind two default-off flags	Offer GA, AdES-compliant, or verifiable post-quantum signatures	PQC preview
Vulnerability disclosure process	Take reports privately, triage by severity, coordinate disclosure	Guarantee a fix, a CVE, or a disclosure date; it is a process commitment	Disclosure policy

Risk & mitigation

Independent validation. Validate output independently and archive the sealed evidence packages as your audit trail.
FIPS boundary. The FIPS-mode policy assists compliance; the validated boundary is the module you configure. Without a CMVP-validated provider or HSM, no FIPS-compatible deployment claim is supportable.
Legal-effect boundary. Signature legal status is jurisdictional. The eIDAS surfaces assert classifications over published evidence; consult your own legal advisers for regulatory obligations.
Preview features. PQC and C2PA synthesis are default-off previews; PQC is signing-only. Keep them off in production.
ionCube connectivity. The encoded channel’s licence lease needs periodic reachability. If that is intolerable, select signed source at purchase.
Fail-safe posture. An ionCube lease lapse or an enforcement failure falls back to the open-source Core; it never bricks. Subscription end is different: a roughly 30-day grace, then perpetual fallback - the installed premium entitlement keeps running, without further updates (Licensing and activation).

What to request next

Evaluate with the full feature set. An evaluation grant runs every capability behind a removable watermark; a 14-day trial (one per email, no charge today, no auto-renew) starts from your account. Begin at the licence portal.
Request the licence envelope for a pilot. It names edition and entitlements and activates per deployment with no application code change (Licensing and activation). Purchases run through our Merchant of Record; the licence is granted by PATEON under the EULA, and refund terms are in the Refund & Cancellation Policy (Buying and licensing).
Collect validation evidence. Module validation evidence comes from your HSM or OpenSSL provider vendor, per your provider class (HSM and FIPS validation); ask NextPDF for integration evidence, and scope a pilot that exercises your trust anchors, validator, and air-gap needs.