Trust center
At a glance
Section titled “At a glance”The NextPDF trust center covers two surfaces: the project’s compliance posture and the engine’s security behavior.
Certifications and compliance. Start at security and compliance: PATEON’s ISO/IEC 27001 company certificate and the NextPDF Licensing Distribution Platform’s CSA STAR self-assessment — each with its registered scope and public evidence link — and the controls the CI and release workflows configure.
Engine behavior. Start with the four posture documents: the engine threat model, the signature and encryption security model, the data-handling and personally identifiable information (PII) behavior, and the vulnerability-disclosure policy. Each documents the defenses built into the core engine and the responsibility split between the library and the deployment that embeds it.
Certifications and compliance
Section titled “Certifications and compliance”| Page | What it covers |
|---|---|
| Security and compliance | PATEON’s ISO/IEC 27001 company certificate and the NextPDF Licensing Distribution Platform’s CSA STAR self-assessment — each with its registered scope and public evidence link — and the controls configured in the CI and release workflows |
| ISO/IEC 27001 certification | PATEON NETWORK TECHNOLOGY INCORPORATED holds ISO/IEC 27001:2022 certificate QCC/B86F/1224 for the company information security management system (ISMS), verifiable on the public IAF CertSearch registry |
| Supply-chain integrity | The supply-chain controls the release workflow configures: cosign release signing, SLSA build provenance, software bill of materials (SBOM) emission, and Vulnerability Exploitability eXchange (VEX) statements |
| Engineering quality | The build-blocking gates continuous integration (CI) enforces: PHPStan Level 10 on src/, a 90% coverage threshold on changed lines, and a mutation-score ratchet |
| Compliance reports | The first-party documents NextPDF authors and maintains: self-assessments, policies, and standards mappings |
Install
Section titled “Install”The trust posture described here applies to the core engine:
composer require nextpdf/core:^3The core test suite ships in the same package.
Conceptual overview
Section titled “Conceptual overview”The four posture documents divide the engine’s security surface:
- Threat model — the attack classes the engine defends against (server-side request forgery (SSRF), XML external entity (XXE) processing, decompression bombs, path traversal, and content injection), the default-deny posture, and the in-code guard that mitigates each class.
- Security model — the cryptographic surface: 256-bit Advanced Encryption Standard (AES-256) document encryption, the reader-cooperative nature of Portable Document Format (PDF) permission bits, and the Cryptographic Message Syntax (CMS)/PDF Advanced Electronic Signatures (PAdES) B-B and B-T signing path.
- Data handling — the data the library reads, holds in memory, and writes; the PII-scrubbing transform applied to audit bundles; and the opt-in telemetry path.
- Disclosure — the coordinated vulnerability disclosure process: private intake channels, response timeline targets, and the embargo model.
Edge cases & gotchas
Section titled “Edge cases & gotchas”- Posture is versioned. The defaults and guards described here are those of the current stable major. The security policy records which majors receive fixes.
- License. NextPDF core is distributed under the Apache-2.0 license.
Security notes
Section titled “Security notes”Every policy object in the engine ships at the strictest position the public API permits; relaxing a control is an explicit caller opt-in, following the baseline-configuration principle of NIST SP 800-53 Rev. 5 CM-7.