iOS PDF SDK security

Nutrient iOS SDK implements the latest and best security practices and is used in security-conscious applications.

Nutrient iOS SDK is distributed as precompiled closed-source XCFrameworks, so we don’t provide LLVM IR artifacts such as .bc or .ll files for third-party scanners. For security reviews, we provide vendor documentation instead; request access to the Nutrient Trust Center(opens in a new tab), which includes compliance materials such as the SOC 2 report.

• Nutrient iOS SDK supports iOS Data Protection(opens in a new tab).
• Encrypted PDFs are supported and cannot be accessed without the matching password.
• PDF passwords are never persisted.
• AESCryptoDataProvider enables you to access encrypted documents by decrypting only the parts that are required to render the page. The parts are dynamically decrypted in memory instead of the entire file being decrypted.
• Document can be initialized with a Data object for custom encryption.
• Signatures are saved in the secure keychain.
• Customers are using Nutrient iOS SDK with GOOD, Mobile Iron, and AirWatch.
• Code commits are always peer reviewed and have to pass our large test case set before being merged.
• We use a large set of compiler warnings and the latest version of Clang Analyzer. This helps us detect and fix potential problems before the product is released.

Permissions

Nutrient iOS SDK has optional features, including adding images or recording sound annotations. If you enable these in your app, make sure to set the required permissions in your Info.plist file.

Security exceptions

Client applications can implement a custom ApplicationPolicy class that manages security-related callbacks. By default, Nutrient iOS SDK will use a standard implementation that enables all special actions. However, you can modify this if you’re in a restricted environment. The following security actions are currently tracked:

public let .openIn: PolicyEvent
public let .print: PolicyEvent
public let .email: PolicyEvent
public let .message: PolicyEvent
public let .quickLook: PolicyEvent
public let .audioRecording: PolicyEvent
public let .camera: PolicyEvent
public let .photoLibrary: PolicyEvent
public let .pasteboard: PolicyEvent // includes Copy/Paste
public let .submitForm: PolicyEvent
public let .network: PolicyEvent

PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventOpenIn;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventPrint;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventEmail;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventMessage;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventQuickLook;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventAudioRecording;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventCamera;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventPhotoLibrary;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventPasteboard; // includes Copy/Paste
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventSubmitForm;
PSPDF_EXPORT PSPDFPolicyEvent const PSPDFPolicyEventNetwork;

class DisallowCopyApplicationPolicy: NSObject, ApplicationPolicy {

    func hasPermission(forEvent event: PolicyEvent, isUserAction: Bool) -> Bool {
        if event == .pasteboard {
            return false
        }
        return true
    }

}

@interface PSCDisallowCopyApplicationPolicy : NSObject <PSPDFApplicationPolicy> @end

@implementation PSCDisallowCopyApplicationPolicy

- (BOOL)hasPermissionForEvent:(PSPDFPolicyEvent)event isUserAction:(BOOL)isUserAction {
    if ([event isEqualToString:PSPDFPolicyEventPasteboard]) {
        return NO;
    }
    return YES;
}

@end

You can register a custom ApplicationPolicy instance by calling SDK.setLicenseKey(_:options:). Nutrient iOS SDK expects your instance to be set in the options dictionary under the SDK.Setting.applicationPolicy key.

Cache

Nutrient iOS SDK caches rendered pages to disk by default to ensure fast display and browsing. You can customize the disk cache at a per-document level via the useDiskCache property or for a data provider. You can also disable it globally by setting its allowedDiskSpace to 0.

Refer to the rendering PDF pages guide for more details.

Specific hooks also enable you to add a custom crypto layer to the disk cache. See decryptionHelper and encryptionHelper.

Implementing a custom crypto layer might decrease performance slightly, but it’s hardly noticeable on modern devices. Nutrient iOS SDK Catalog contains sample code using the open source RNCryptor(opens in a new tab).

Security-related considerations

• Nutrient iOS SDK might keep parts of extracted text, annotations, or passwords in memory to perform the requested operations. If rogue code has access to your application’s memory, there’s nothing you can do and the device has already been compromised. This could happen if a device is jailbroken.
• Taking a screenshot cannot be prevented on iOS. A UIApplicationUserDidTakeScreenshotNotification notification fires when the user takes a screenshot using the Lock+Home Button combination. However, other methods — such as Xcode’s Device Manager — can capture screenshots without emitting that notification.
• Using Document with data in memory via DataContainerProvider only works for small documents, and they must fit into the available process memory space. This is device and state dependent. When saving annotations, the NSData object is mutated. Use the document delegate pdfDocumentDidSave(_:) to save the data object back to your (encrypted) disk store. However, it’s strongly recommended to use AESCryptoDataProvider or a custom implementation of DataProviding to avoid loading the entire file in memory.

Network access

Nutrient iOS SDK only performs network access when required for the following actions:

• Submitting a PDF form
• Accessing images/videos/audio from the gallery (www.youtube.com, img.youtube.com)
• Looking up text in Wikipedia (%@.m.wikipedia.org)
• Via the inline web browser if a URL was tapped (WebViewController)
• Adding or verifying digital signatures:
  • Verifying the timestamp of a digital signature (via Botan(opens in a new tab))
  • Adding a timestamp to a digital signature (when SigningConfiguration.timeStampSource is set while signing)
  • Adding LTV information when signing a document (if SigningConfiguration.isLongTermValidationEnabled is enabled while signing)
  • Checking the revocation status for a digital signature (in PDFSignatureValidator and SignedFormElementViewController)

Production license verification happens offline and does not ping our servers.

Data collection practices

Nutrient iOS SDK doesn’t collect any data from production applications. Refer to our Privacy Policy for more information.

When using Nutrient Instant(opens in a new tab), user data such as the user ID and name (i.e. the annotation author name) will be sent to the Instant server. Users can also upload photos when creating image annotations, or audio recordings when using sound annotations. Since the Instant server is self-hosted, this data never reaches any Nutrient servers.

Copy text

PDF documents have a flag that indicates if copying text is allowed, which is reflected in the DocumentPermissions.extract flag in the permissions property of Document. This is a read-only property that cannot be changed.

To disable copying text when a PDF enables it, implement the ApplicationPolicy protocol in a custom class as explained above.

Cryptographic libraries

Nutrient iOS SDK uses the Apple-provided CommonCrypto(opens in a new tab) library for AES-256 decryption, licensing, Digital Signatures, and some platform-specific functionality. In addition, it uses the Botan(opens in a new tab) library for licensing and Digital Signatures. It also relies on a few document encryption routines provided by the PDFium(opens in a new tab) library.

For the complete list of third-party libraries used in Nutrient iOS SDK, check out the acknowledgements.