TerraPDF for Enterprise
The answers your architecture review, security team, and procurement process will ask for — licensing, supply chain, security posture, support lifecycle, and what TerraPDF deliberately does not do yet.
Licensing & procurement
TerraPDF is licensed under the MIT License
(SPDX identifier: MIT) — one of the two licenses on virtually every corporate
open-source allowlist. There is nothing to procure:
- Free for commercial use at any scale — no per-developer, per-server, per-document, or SaaS-deployment fees
- No license keys, activation, or telemetry — the package makes no network calls
- No dual licensing, no "community vs. commercial" tiers, no license audit exposure
- Redistribution and modification permitted, including in closed-source products
Supply chain & provenance
| Runtime dependencies | None. Pure C# — no transitive packages, no native binaries. Your dependency-scanning surface for TerraPDF is exactly one package. |
| Source availability | Full source on GitHub; you can audit, fork, or build from source (dotnet build, no special toolchain). |
| Reproducible builds | Releases are built with <Deterministic> and <ContinuousIntegrationBuild> enabled, producing reproducible, byte-identical assemblies. |
| Debuggability | Every release ships a .snupkg symbol package with Source Link, so you can step directly into TerraPDF source from your debugger. |
| Release process | Packages are built and pushed to NuGet.org by GitHub Actions on release tags — not from a developer machine. See the publishing process. |
Security posture
- No custom cryptography. AES-256 / AES-128 encryption and SHA-2 key derivation use .NET's
System.Security.Cryptography, which delegates to the platform's crypto libraries — TerraPDF inherits your environment's .NET and OS FIPS configuration rather than shipping its own primitives. - AES-256 by default (PDF 2.0, Standard Security Handler Revision 6) since v1.4.0, with user/owner passwords and granular permission flags. Encryption docs →
- Coordinated disclosure. A published security policy with response-time targets, GitHub private vulnerability reporting, and a machine-readable security.txt.
- No data leaves your process. PDF generation is a fully in-memory, offline operation — no telemetry, no external services, safe for air-gapped environments.
Vulnerability response targets
| Stage | Target time |
|---|---|
| Acknowledgement | ≤ 2 business days |
| Initial assessment | ≤ 5 business days |
| Fix and patched release (critical / high) | ≤ 30 days |
| Public disclosure | Coordinated with reporter after the fix ships |
Versioning & support lifecycle
- Releases follow Semantic Versioning; breaking changes are called out explicitly in the changelog (Keep a Changelog format)
- The latest 1.x release line receives fixes and security patches; older major versions are not supported
- Planned work is tracked publicly on GitHub issues and milestones
Deployment & compatibility
- Targets .NET 8, .NET 9, and .NET 10 — runs anywhere they do: Windows, Linux, macOS, Docker/Kubernetes containers, Azure App Service & Functions, AWS Lambda
- No native binaries means no platform-specific deployment steps, no
libgdiplus-style Linux surprises, and identical behavior across operating systems - Concurrency guidance: generation is a self-contained in-memory operation. Treat each document build as single-threaded — create one document per request or thread (the natural pattern in ASP.NET Core), and generate as many documents in parallel as you like
Current limitations — the honest list
TerraPDF is focused on generating new documents with a code-first API. If your requirements include the following today, TerraPDF is not yet the right fit, and we would rather you know now:
| Capability | Status |
|---|---|
| PDF/A (archival) and PDF/UA (accessibility) conformance | Not currently supported |
| Custom TrueType/OpenType font embedding | Not yet — built-in standard fonts (Helvetica, Times, Courier) with WinAnsi character coverage |
| Full Unicode text (CJK, Cyrillic, Arabic, …) in page content | Not yet — follows from the built-in-font limitation above; metadata and bookmarks do support UTF-16 |
| Editing, merging, or splitting existing PDFs | Out of scope — TerraPDF generates new documents only |
| Digital signatures (PAdES) | Not currently supported |
| Interactive forms (AcroForms) creation | Not currently supported |
| HTML-to-PDF conversion | Out of scope — TerraPDF is code-first by design |
Feature requests are prioritized in the open on GitHub — if one of these blocks your adoption, say so there or contact us.
Evaluating TerraPDF for your organization?
We're happy to answer architecture, security, or licensing questions directly.
dotnet add package TerraPDF
Contact Us
Read the FAQ