Security and compliance
PATEON NETWORK TECHNOLOGY INCORPORATED, the company behind NextPDF, holds
ISO/IEC 27001:2022 certificate QCC/B86F/1224 for its information security
management system. The NextPDF Licensing Distribution Platform — the licensing
cloud service — carries a published CSA STAR Level 1 self-assessment
(CAIQ v4.1.0).
Certification
Section titled “Certification”PATEON NETWORK TECHNOLOGY INCORPORATED holds ISO/IEC 27001:2022 certificate
QCC/B86F/1224 for the company’s information security management system. The
certificate’s registered scope:
Specializing in information software services, data processing, third-party payment, software wholesale and retail, computer equipment installation and manufacturing, advertising services, management and leasing consulting, and other legally permitted activities as per the Statement of Applicability Version 1.1 dated 9th August 2024.
Verify the certificate on IAF CertSearch.
Published self-assessment
Section titled “Published self-assessment”CSA STAR Level 1 is the Cloud Security Alliance’s self-assessment tier: the
vendor’s control responses are published on the public STAR Registry for you to
read, mapped to the Cloud Controls Matrix. NextPDF publishes a CAIQ v4.1.0
self-assessment for the NextPDF Licensing Distribution Platform — the
licensing cloud service — on the
CSA STAR Registry.
Registry evidence
Section titled “Registry evidence”| Claim | Type | Evidence |
|---|---|---|
ISO/IEC 27001:2022 — PATEON NETWORK TECHNOLOGY INCORPORATED company ISMS, certificate QCC/B86F/1224 | External certification | IAF CertSearch |
CSA STAR Level 1 self-assessment (CAIQ v4.1.0) — NextPDF Licensing Distribution Platform | NextPDF-authored self-assessment | CSA STAR Registry |
Deployed CI and workflow gates
Section titled “Deployed CI and workflow gates”Gate-by-gate detail: Supply-chain integrity and Engineering quality.
| Gate | Configuration |
|---|---|
| Supply chain | Emits a CycloneDX 1.7 SBOM of the build, records an in-toto statement committing to the build inputs, and diffs SHA-256 dependency fingerprints against a pinned baseline — hard gates on every dependency-changing pull request and every version tag |
| Static analysis | PHPStan Level 10 on src/, build-blocking on every push and pull request |
| Coverage | A 90% threshold on the lines each pull request changes, measured with PCOV against the base branch; a pull request below the threshold fails the build |
| Mutation score | Monotonically non-decreasing floors on raw_msi, effective_msi, and covered_msi; a pull request that would drop any floor below its minimum is rejected |
| Output validation | veraPDF 1.30.1 with the pdfua.strict profile, build-blocking on the tagged-output corpus |