The architecture, the data protection position, the deployment notes and a completed vendor questionnaire — including the answers that are unfavourable. No form, no sales call, no waiting for an email.
Describes Oxofolio 0.1.3. Every technical statement in these documents is generated from the application's source and the release build fails if they are out of date with it.
Most of a supplier review is about what happens to data once it reaches the vendor. Here the answer collapses: nothing reaches us, and the claim is checkable rather than asserted.
| What a review asks | Answer |
|---|---|
| Is customer data transmitted to the supplier? | No The application makes no network connections at all. No telemetry, no usage data, no crash reports. |
| Where is customer data stored? | Your machine In your own folders. We operate no infrastructure that holds customer data. |
| Who are your sub-processors? | None There is no processing off the machine, so there is nothing to sub-contract. |
| Is a data processing agreement needed? | Not for the software We are neither controller nor processor for your documents — not under GDPR Article 4(8), nor as a Data Processor under the DPDP Act. |
| What is the cross-border transfer mechanism? | There is no transfer No Chapter V GDPR transfer, and no transfer outside India under section 16 of the DPDP Act. |
| Can it run without administrative rights? | Yes It installs per-user and needs no elevated privileges. |
Ask your IT team to run netstat while Oxofolio is open. That is the entire demonstration, and no web-based competitor can offer it.
A security pack containing only good news is not usable by the person who has to sign it off. These are the same answers as in the questionnaire, in the same words.
| Question | Answer |
|---|---|
| Is the application code signed? |
Two of three platforms
macOS: yes — Developer ID Application, hardened runtime, notarised by Apple and stapled.
Windows: no — the installer is unsigned, so SmartScreen warns on first run. The certificate is the only outstanding item.
Linux: the .rpm is GPG-signed against a published key.
|
| Has it been penetration tested? | Not independently Stated plainly rather than omitted. |
| Do you hold SOC 2 or ISO 27001? | No Neither certification is held. |
| Do you log who downloads the software? | The website does The CDN does not log at all. This website records the platform, version, time, IP address and browser agent of a download, which the privacy policy states. They are access records, hold no document data, and are not linked to any licence or purchase. |
| What are the limits of secure erasure? | NIST 800-88 Clear Not Purge, not Destroy. On a solid-state drive, wear levelling can leave the original block intact until it is reused. Full-disk encryption is what makes such residue worthless, and the erasure certificate records whether it was enabled. |
| Anything odd an endpoint agent might flag? | Yes, one thing The bundled Windows tesseract.exe is the upstream UB Mannheim build, unmodified, and carries a third-party signature whose issuing certificate has expired. An agent may treat that more harshly than an unsigned binary. |
Markdown and JSON rather than PDF, so they diff cleanly against the next release. Each is published with its SHA-256, for the same reason the installers are.
The architecture, process by process: what the renderer can reach, what the sidecar can reach, and where the network surface would be if there were one. Start here.
MD · 11.2 KBb2fc1f47b225c891774f8b6c57e27157ca1c04bc3368a335d3683956dda1be02
The questions a supplier review asks, answered — including the ones where the answer is unfavourable. Signing, penetration testing, certifications and logging are all in here.
MD · 6.2 KB4bd5324f0af62fb64768f0cea2a453a5e0fbaba4928faadea56fdecba7b24359
Why the supplier is neither controller nor processor for your documents, what that means for a DPA, and the honest limits of the redaction and erasure functions.
MD · 2.6 KB2e3e098fd2b0fd52a218056fd61ce0d19f3fdd8f2a4c2bb999915907364ca5cb
Installing without administrative rights, what the application writes and where, and what to allow through an endpoint agent.
MD · 2.5 KBcf2e7b3c40ae46920c2cede5675bcaf7eb14ed9bf7d79768c4f57e8d5651f824
Every dependency that ships inside the application, with the licence each declares.
MD · 1.8 KB63582fde95d7a39dc768d0eb7472138aefe5403433f58dd580414744ffe71761
The full inventory as JSON, generated from the committed lockfiles with the integrity hash of every resolved package, so it can be diffed against an advisory feed.
JSON · 89.5 KBc8c1ddc6858c2ed374f013189d6ec0b00ab6b04652bff97dfa7db8ff034b436c
Every document above concatenated into one file, for filing or forwarding.
MD · 24.6 KB046d5a0b5e2f29f5ecb500aba172a6638dc618b00538986bc7d3a638d9e078f6
Some of the answers above are verified on every release build rather than merely believed — which is the difference between a policy and a property.
A scan rejects networking patterns across the whole shipped source tree, and it runs before every release. It catches the accidental telemetry import that would otherwise end this product's central claim.
The build does not request the com.apple.security.network.client entitlement, so the operating system refuses outbound networking whatever the code tries. Not a policy — a permission that was never granted.
A preflight gate runs every one of the document operations against the frozen binary. An operation the gate never calls is an operation nobody notices breaking.
The signing check turns an unsigned build into a build failure under the release flag, so the Windows gap cannot ship by accident while it is being fixed.
It is generated from the application's source, and the release build fails if the documents are out of date with respect to the code they describe.
Licences are Ed25519 signatures verified against a public key compiled into the app. There is no activation call, so there is no check that could fail and no server that could see you.