A PDF is a file, not a program.

Network

Folielle goes online only when you ask it to:

• Signature checks run offline when a file opens. Windows is told not to fetch certificates or revocation lists from addresses written inside the document. Press Refresh in the Signatures panel to check revocation online.
• Timestamps are requested from a timestamp server only if you set one when signing.
• Text recognition languages beyond the included ones are downloaded only when you choose them.

Inert documents

PDFs can carry instructions to run scripts, open programs or contact websites. Folielle ignores them all:

• JavaScript in the document, on open, on page view or in form fields
• Launch actions, web links and links to other files or network shares that try to run by themselves
• Form submission and data import actions
• Embedded files and attachments, which are never opened for you
• Remote content in XFA forms and rich media

Our automated tests open files built to try each of these and check that nothing happens.

Signatures

• A signature is shown as valid only when the document is intact since signing, the signer's certificate chains to a trusted root, and revocation was checked. If revocation wasn't checked, Folielle says so instead of calling it valid.
• Certificates must be meant for signing documents. An ordinary website certificate is not accepted as a trusted document signer.
• Changes made after signing are listed and judged against what the signer allowed.
• Signing uses Windows' own cryptography. Private keys stay in your certificate store or on your smart card; a .pfx password is kept in memory only.

Redaction

• Text, image pixels and drawings under each mark are removed from the page, not covered with a box.
• The result is a newly written file with a single version, so earlier copies of the text can't hide in its history.
• Before saving, Folielle checks the new file for anything that should be gone. If it finds any, nothing is saved.
• Afterwards, Folielle clears its own page previews and older saved versions of that file, so the unredacted pages don't linger on your PC.

Passwords and encryption

• Document passwords stay in memory. They are never written to disk, to logs, or onto a command line where other programs could read them.
• Saving a password-protected file keeps its protection.
• Redacting or removing hidden information from a protected file produces a file protected with AES-256 and the same password. Folielle checks that before it replaces anything.

Isolation

• PDFs are read in separate helper processes. If a damaged or hostile file crashes one, the app and your other documents carry on.
• Those helpers can't use the clipboard, control other windows or change system settings.
• Folielle loads its components only from its own folder and Windows, never from the folder of the file you opened.
• Office documents downloaded from the internet ask before they're converted, and Office macros stay off.

Safe saving

• Every save goes to a temporary file first, is checked for structural errors and reopened, and only then replaces your file.
• If anything fails, your original stays as it was.
• Crash recovery copies stay on your PC, and temporary files left by a crash are tidied up at the next start.

Report a problem

Found a security issue? Email support@folielle.com with "Security" in the subject. Please give us a chance to fix it before you share details publicly.