The architecture, the data protection position, the deployment notes and a completed vendor questionnaire — including the answers that are unfavourable. Published in full, with no form and no sales call. The version-pinned component inventory is the one thing we send rather than post, and why is on its own page.
Describes Oxofolio 0.2.1. Every technical statement in these documents is generated from the application's source and the release build fails if they are out of date with it.
Most of a supplier review is about what happens to data once it reaches the vendor. Here the answer collapses: nothing reaches us, and the claim is checkable rather than asserted.
| What a review asks | Answer |
|---|---|
| Is customer data transmitted to the supplier? | No The application makes no network connections at all. No telemetry, no usage data, no crash reports. |
| Where is customer data stored? | Your machine In your own folders. We operate no infrastructure that holds customer data. |
| Who are your sub-processors? | None There is no processing off the machine, so there is nothing to sub-contract. |
| Is a data processing agreement needed? | Not for the software We are neither controller nor processor for your documents — not under GDPR Article 4(8), nor as a Data Processor under the DPDP Act. |
| What is the cross-border transfer mechanism? | There is no transfer No Chapter V GDPR transfer, and no transfer outside India under section 16 of the DPDP Act. |
| Can it run without administrative rights? | Yes It installs per-user and needs no elevated privileges. |
Ask your IT team to run netstat while Oxofolio is open. That is the entire demonstration, and no web-based competitor can offer it.
A security pack containing only good news is not usable by the person who has to sign it off. These are the same answers as in the questionnaire, in the same words.
| Question | Answer |
|---|---|
| Is the application code signed? |
Every platform
macOS: yes — Developer ID Application, hardened runtime, notarised by Apple and stapled.
Windows: yes — the installer and everything inside it are signed as CHADURA TECH PRIVATE LIMITED and timestamped, so the signatures outlive the certificate. That includes the sidecar, the bundled OCR engine and the DLLs beside them, because an unsigned binary inside a signed installer is what an endpoint agent quarantines. It is an OV certificate, not EV: SmartScreen may still warn until reputation accrues against the certificate. Signing is what makes Windows name the publisher; it is not what silences SmartScreen.
Linux: the .rpm is GPG-signed against a published key.
|
| Has it been penetration tested? | Not independently Stated plainly rather than omitted. |
| Do you hold SOC 2 or ISO 27001? | No Neither certification is held. |
| Do you log who downloads the software? | The website does The CDN does not log at all. This website records the platform, version, time, IP address and browser agent of a download, which the privacy policy states. They are access records, hold no document data, and are not linked to any licence or purchase. |
| What are the limits of secure erasure? | NIST 800-88 Clear Not Purge, not Destroy. On a solid-state drive, wear levelling can leave the original block intact until it is reused. Full-disk encryption is what makes such residue worthless, and the erasure certificate records whether it was enabled. |
| Is data encrypted at rest? | By your disk, not by us Documents are left as you store them, so at-rest encryption is whatever your disk encryption provides — full-disk encryption is recommended and the application reports whether it is enabled. Document passwords you ask it to remember go to the OS keystore (Keychain, DPAPI) and are not written at all if the OS cannot encrypt them. |
Each opens as a page, downloads as a PDF, and keeps its markdown or JSON source so it diffs cleanly against the next release. All three are published with the SHA-256 of the source, for the same reason the installers are.
The architecture, process by process: what the renderer can reach, what the sidecar can reach, and where the network surface would be if there were one. Start here.
PDF · source · MD · 11.4 KB5ebdf6bf0d83e4d27ea7d8644415a6b9edae9119a642df3911f83eb99d39c38b
The questions a supplier review asks, answered — including the ones where the answer is unfavourable. Signing, penetration testing, certifications and logging are all in here.
PDF · source · MD · 6.4 KBd438371e26cb5c321e697fbc6a816597b37dfba8ba75ce5c3883a1734c40d61f
Why the supplier is neither controller nor processor for your documents, what that means for a DPA, and the honest limits of the redaction and erasure functions.
PDF · source · MD · 2.6 KB2e3e098fd2b0fd52a218056fd61ce0d19f3fdd8f2a4c2bb999915907364ca5cb
Installing without administrative rights, what the application writes and where, and what to allow through an endpoint agent.
PDF · source · MD · 3.0 KBd0567d02cadeba415b4894b94ddb9e0f8a4b1ad04a20b978e88367e71c87145d
| Sent on request | Why it is not posted |
|---|---|
| Third-party components MD · 2.4 KB |
Every dependency that ships inside the application, with the licence each declares. |
| Software bill of materials JSON · 62.1 KB |
The full inventory as JSON, generated from the committed lockfiles with the integrity hash of every resolved package, so it can be diffed against an advisory feed. |
| The complete pack MD · 26.3 KB |
Every document above concatenated into one file, for filing or forwarding. |
These pin exact versions of the document parsers, and a published inventory is greppable at scale by somebody who never had to choose this product. The reasoning in full, or just ask us and we will send them — no NDA and no qualification questions.
Some of the answers above are verified on every release build rather than merely believed — which is the difference between a policy and a property.
A scan rejects networking patterns across the whole shipped source tree, and it runs before every release. It catches the accidental telemetry import that would otherwise end this product's central claim.
The build does not request the com.apple.security.network.client entitlement, so the operating system refuses outbound networking whatever the code tries. Not a policy — a permission that was never granted.
A preflight gate runs every one of the document operations against the frozen binary. An operation the gate never calls is an operation nobody notices breaking.
The signing check turns an unsigned build into a build failure under the release flag. It was written while Windows was the gap; now that every platform is signed it is what stops one silently going back.
It is generated from the application's source, and the release build fails if the documents are out of date with respect to the code they describe.
Licences are Ed25519 signatures verified against a public key compiled into the app. There is no activation call, so there is no check that could fail and no server that could see you.