TerraPDF for Enterprise
The answers your architecture review, security team, and procurement process will ask for — licensing, supply chain, security posture, support lifecycle, and what TerraPDF deliberately does not do yet.
Licensing & procurement
TerraPDF is licensed under the MIT License
(SPDX identifier: MIT) — one of the two licenses on virtually every corporate
open-source allowlist. There is nothing to procure:
- Free for commercial use at any scale — no per-developer, per-server, per-document, or SaaS-deployment fees
- No license keys, activation, or telemetry — the package makes no network calls
- No dual licensing, no "community vs. commercial" tiers, no license audit exposure
- Redistribution and modification permitted, including in closed-source products
Supply chain & provenance
| Runtime dependencies | None. Pure C# — no transitive packages, no native binaries. Your dependency-scanning surface for TerraPDF is exactly one package. |
| Source availability | Full source on GitHub; you can audit, fork, or build from source (dotnet build, no special toolchain). |
| Reproducible builds | Releases are built with <Deterministic> and <ContinuousIntegrationBuild> enabled, producing reproducible, byte-identical assemblies. |
| Debuggability | Every release ships a .snupkg symbol package with Source Link, so you can step directly into TerraPDF source from your debugger. |
| Release process | Packages are built and pushed to NuGet.org by GitHub Actions on release tags — not from a developer machine. See the publishing process. |
Security posture
- No custom cryptography. AES-256 / AES-128 encryption and SHA-2 key derivation use .NET's
System.Security.Cryptography, which delegates to the platform's crypto libraries — TerraPDF inherits your environment's .NET and OS FIPS configuration rather than shipping its own primitives. - AES-256 by default (PDF 2.0, Standard Security Handler Revision 6) since v1.4.0, with user/owner passwords and granular permission flags. Encryption docs →
- Coordinated disclosure. A published security policy with response-time targets, GitHub private vulnerability reporting, and a machine-readable security.txt.
- No data leaves your process. PDF generation is a fully in-memory, offline operation — no telemetry, no external services, safe for air-gapped environments.
Vulnerability response targets
| Stage | Target time |
|---|---|
| Acknowledgement | ≤ 2 business days |
| Initial assessment | ≤ 5 business days |
| Fix and patched release (critical / high) | ≤ 30 days |
| Public disclosure | Coordinated with reporter after the fix ships |
Versioning & support lifecycle
- Releases follow Semantic Versioning; breaking changes are called out explicitly in the changelog (Keep a Changelog format)
- The latest 1.x release line receives fixes and security patches; older major versions are not supported
- Planned work is tracked publicly on GitHub issues and milestones
Deployment & compatibility
- Targets .NET 8, .NET 9, and .NET 10 — runs anywhere they do: Windows, Linux, macOS, Docker/Kubernetes containers, Azure App Service & Functions, AWS Lambda
- No native binaries means no platform-specific deployment steps, no
libgdiplus-style Linux surprises, and identical behavior across operating systems - Concurrency guidance: generation is a self-contained in-memory operation. Treat each document build as single-threaded — create one document per request or thread (the natural pattern in ASP.NET Core), and generate as many documents in parallel as you like
Current limitations — the honest list
TerraPDF is focused on generating new documents with a code-first API. If your requirements include the following today, TerraPDF is not yet the right fit, and we would rather you know now:
| Capability | Status |
|---|---|
| PDF/A (archival) and PDF/UA (accessibility) conformance | Not currently supported |
| Custom TrueType/OpenType font embedding | Not yet — built-in standard fonts (Helvetica, Times, Courier) with WinAnsi character coverage |
| Full Unicode text (CJK, Cyrillic, Arabic, …) in page content | Not yet — follows from the built-in-font limitation above; metadata and bookmarks do support UTF-16 |
| Editing, merging, or splitting existing PDFs | Out of scope — TerraPDF generates new documents only |
| Digital signatures (PAdES) | Not currently supported |
| Interactive forms (AcroForms) creation | Not currently supported |
| HTML-to-PDF conversion | Out of scope — TerraPDF is code-first by design |
Feature requests are prioritized in the open on GitHub — if one of these blocks your adoption, say so there or contact us.
Evaluating TerraPDF for your organization?
We're happy to answer architecture, security, or licensing questions directly.