This one we send rather than publish.
The architecture, the data-protection position, the deployment notes and the completed questionnaire are all published in full. The version-pinned component inventory is not — ask and we will send it, usually the same day.
Not because it is secret.
Anyone who has decided to look can extract this from the installer. The reason it is not on a public page is that a published inventory is greppable at scale: an attacker never has to choose this product — they run a script across published inventories looking for a known-vulnerable version, and find it without ever having heard of us.
The versions that matter here are the document parsers. For an application that opens no network connections, the realistic way in is a malicious document, not an intrusion — so the list of exactly which parser versions are inside is the one piece of this pack with real value to somebody who means harm and little to anybody else.
This is the same line Adobe and Microsoft draw: architecture and security documentation published, version-pinned inventories delivered to customers and reviewers rather than posted.
What you get by asking
- Third-party components — Every dependency that ships inside the application, with the licence each declares.
- Software bill of materials — The full inventory as JSON, generated from the committed lockfiles with the integrity hash of every resolved package, so it can be diffed against an advisory feed.
- The complete pack — Every document above concatenated into one file, for filing or forwarding.
Sent as the file, with its SHA-256, so it diffs cleanly against the next release. No NDA, no sales call, no qualification questions — tell us who you are and we will send it.