Security

The short version, with the same seals as in the app under Settings > Privacy & data.

• No server receives documents: there is no upload path in the app
• The macOS app runs in Apple's App Sandbox and opens only the files and folders you choose
• PDF rendering, text recognition, name finding, redaction and checks run on the device
• Temporary files live in the app's own folder and are deleted as soon as they are no longer needed
• Passwords for protected PDFs are kept in memory only while the file is open

Deleted means removed, not overwritten: modern drives may keep old data for a while. We recommend FileVault on a Mac and BitLocker on Windows.

• Three kinds of connections: license checks with Lemon Squeezy, optional rule template updates and error reports to Sentry
• All use HTTPS; template updates are signed and used only after their signature is checked
• Updates add new templates and never change your own rule sets
• Error reports carry no files, document text, names or email addresses; apart from crash reports they can be turned off in Settings > Privacy & data

• HTTPS only, with HSTS, a strict Content Security Policy and framing disabled
• Same-origin checks on every form submission
• Contact form protected by Cloudflare Turnstile with single-use tokens
• No third-party scripts before consent, except the spam check on the contact page

• GDPR: error reports rely on our legitimate interest in a stable, secure app (Art. 6(1)(f)); crash reports are always sent, the other reports only while Settings > Privacy & data > Send diagnostics is on
• Error reports are transferred to the United States under Sentry's data processing terms, which include the Standard Contractual Clauses
• California (CCPA/CPRA): we do not sell or share personal information, and we honor Global Privacy Control

Read more: Privacy policy · EU & UK (GDPR) · United States · Canada (PIPEDA, Law 25)

• Documents are redacted on your computer and never uploaded, so we do not receive or store protected health information (PHI)
• Your organization stays responsible for its HIPAA compliance
• We do not sign Business Associate Agreements

• A report holds the error and where in the code it happened, the app and system versions, the computer model, a random installation ID, and the IP address Sentry receives with every request
• Never your files, document text, the terms you redact, license keys, your name or email address; paths and quoted text are removed before sending
• Crash reports are always sent; everything else only while Settings > Privacy & data > Send diagnostics is on (it is on by default)
• Sentry keeps reports for 90 days and holds ISO 27001 and SOC 2 Type 2 certifications

• Website purchases: Lemon Squeezy, a Stripe company, is the merchant of record; card payments run on Stripe's PCI DSS Level 1 certified infrastructure
• We never see or store your card details
• If you buy the Mac App Store edition, Apple handles the purchase, payment and refunds
• If you buy the Microsoft Store edition, Microsoft handles the purchase, payment and refunds

• Settings, history and your license are kept in the operating system's protected storage: the Keychain on a Mac, DPAPI-protected files on Windows
• Activation sends Lemon Squeezy your license key and a random device label such as “Mac 3f9a”, never your computer's name
• The licenses of the open-source components are in the app under Settings > Legal > Open-source licenses

Page rebuilding, the clean-file whitelist, hidden-content detection and the six checks, step by step.

Read the technical overview →