We also make a cloud product under this name. This is not it.  Use that one and you are uploading on purpose.
§ 02  The proof you can run in five seconds

Turn on airplane mode. Everything still works.

That is the whole test, and you do not have to take our word for any part of it. There is exactly one exception, and here it is rather than in a footnote:

The one exception

The optional timestamp on a digital signature asks a public time authority to attest the hour. It sends a hash, never your document, and it does nothing unless you turn it on. It is off by default, and the switch is in plain sight.

One outbound request, by your choice, carrying no document.

What we will not tell you

We do not claim this application cannot reach the network. Windows does not let an ordinary desktop application permanently give up network access, so anyone who tells you their Windows app is incapable of it is telling you something they cannot back.

No mechanism claim. Only what the code does, and what you can check.
§ 04  The part nobody else mentions

Delete a page in most tools and the page is still in the file.

The PDF format lets a writer append changes and leave every original byte in place. Cover a salary figure, remove a page, redact a name — if the tool appends, the original is still in the file you send, and any text extractor gets it back.

Incremental save — the common default

REVISION 1 · REVISION 2 · REVISION 3 — all delivered

Looks perfect in a viewer. The removed content is still there, chained through /Prev.

What you removed, you still sent.

What this application does instead

ONE REVISION — the file is rebuilt

The flag is never passed and is not exposed anywhere. After writing, we re-read our own output and refuse to hand back bytes that contain more than one revision.

Countersigning is the one checked exception, and it says so when it happens.
§ 05  Where your document is actually opened

No PDF is parsed in the window you are looking at.

Every file you open is attacker-controlled — it came from a portal, an employer, or a stranger. So the parser never runs beside your interface.

Process A
The window you clicked

Draws the interface. Holds your file list. Never maps the PDF engine at all — and prints a self-check saying so.

Process B — confined, disposable
The worker

Started inside a Windows job object with process mitigations, handed the bytes, and taken down afterwards. The only place PDFium is ever mapped.

402/424
Samples with the engine in the worker,
during a real 4,000-page split
0/424
Samples with the engine in
the front end
10/18
PDFium CVEs this year that were
use-after-free — which is why we build
the engine ourselves, with the allocator
hardening left on