Turn on airplane mode. Everything still works.
That is the whole test, and you do not have to take our word for any part of it. There is exactly one exception, and here it is rather than in a footnote:
The one exception
The optional timestamp on a digital signature asks a public time authority to attest the hour. It sends a hash, never your document, and it does nothing unless you turn it on. It is off by default, and the switch is in plain sight.
What we will not tell you
We do not claim this application cannot reach the network. Windows does not let an ordinary desktop application permanently give up network access, so anyone who tells you their Windows app is incapable of it is telling you something they cannot back.
Delete a page in most tools and the page is still in the file.
The PDF format lets a writer append changes and leave every original byte in place. Cover a salary figure, remove a page, redact a name — if the tool appends, the original is still in the file you send, and any text extractor gets it back.
Incremental save — the common default
REVISION 1 · REVISION 2 · REVISION 3 — all delivered
Looks perfect in a viewer. The removed content is still there, chained through /Prev.
What this application does instead
ONE REVISION — the file is rebuilt
The flag is never passed and is not exposed anywhere. After writing, we re-read our own output and refuse to hand back bytes that contain more than one revision.
No PDF is parsed in the window you are looking at.
Every file you open is attacker-controlled — it came from a portal, an employer, or a stranger. So the parser never runs beside your interface.
Process A
Draws the interface. Holds your file list. Never maps the PDF engine at all — and prints a self-check saying so.
Process B — confined, disposable
Started inside a Windows job object with process mitigations, handed the bytes, and taken down afterwards. The only place PDFium is ever mapped.
during a real 4,000-page split
the front end
use-after-free — which is why we build
the engine ourselves, with the allocator
hardening left on