Every other security page explains how carefully a company guards the copy of your file on its servers. This one shows you why there isn't a copy.
There is no upload path in the software. Not one that's switched off — none at all. A setting can be misconfigured; an absent code path cannot.
Enterprise sends nothing at all, ever. If your requirement is zero outbound traffic under all conditions, that's the tier — organisation-wide signed files, deployed by your own tooling, to machines with no route out.
Most tools draw a rectangle over the words and leave them in the file. Select the text in both panels below and paste it somewhere.
If a single word survives the check, the operation reports itself as failed rather than quietly succeeding. Redaction is the one place where "probably worked" is worthless, so it's the one place we verify instead of assume.
Licences are signed files. The app holds only the public verification key; the private key never leaves our infrastructure. A forged or altered licence fails verification offline.
Each licence is locked to the machine it was issued to, with drift tolerance so a replaced network card doesn't lock out a paying user. A copied licence won't run elsewhere.
Trial and licence state is AES-256-GCM encrypted and machine-bound, so it can't be copied to another machine to extend anything.
The app keeps a monotonic record of the furthest time it has ever seen. Winding the system clock backwards is detected and rejected.
Account sign-in is a one-time emailed link. We store no passwords, so there are none to breach, reuse or leak.
The OCR engine and document converter are bundled inside the application. Nothing is downloaded while it runs, so there's nothing to intercept or substitute.
Some software is built on components with copyleft licences — AGPL and GPL. Sell a product built on those and you can be obliged to publish your own source code, which is why many corporate and government open-source policies ban them outright. A product containing one needs a legal review before anyone can buy it.
VellumDoc contains none. Every third-party component is MIT, BSD or Apache — licences that place no obligation on us or on you. And nothing here is a paid library whose vendor could raise the price, change the terms, or withdraw it while you're mid-contract.
This wasn't luck. The PDF compression engine was originally an AGPL library — it was removed and rewritten from scratch on permissive components, specifically so that a procurement reviewer opening our component list finds nothing to escalate.
Security questionnaires ask the same six questions. Here are the answers, in the form they're usually wanted.
Need this on letterhead, or a specific questionnaire completed? Ask us — procurement requests get answered first.
This is the rare security claim you can test yourself, without trusting us at all.
Deny all outbound traffic for VellumDoc and process a hundred files. Everything works identically, because there was never a call to make.
Run Little Snitch, LuLu or your own network monitoring while you work. After activation there is nothing to see.
Put it on a machine with no network interface at all. Every feature still runs — that's what Enterprise deployment relies on.
Every feature for 30 days. No account, no card, no upload.