Cyber Resilience Act Public Documentation, Version 1.0
Last updated: Wednesday, September 16, 2026
This information provides a general overview of our approach to the EU Cyber Resilience Act. The specific requirements applicable to an individual product depend on its functionality, classification, and date of placement on the market. Where applicable and required, the appropriate declaration of conformity is available in the respective product's 'About' menu.
Our Software
Our macOS applications operate locally on the user's computer. Documents and their contents are processed and stored locally, and are not transmitted to us. Network communication is limited to functions such as checking for and downloading software updates using the Sparkle update framework, and validating the supplied software license. License validation is used solely to verify the validity of a license. It is not used for telemetry or usage tracking.
Security and Updates
We consider cybersecurity throughout the development and maintenance of our software. This includes secure software distribution and updates, handling of vulnerabilities, review of relevant third-party components and appropriate testing of externally supplied data and documents. For products subject to the applicable CRA requirements, we define a cybersecurity support period and provide necessary security updates during that period. Our products are designed exclusively for Apple macOS and rely on operating-system functionality, frameworks, APIs, and security mechanisms provided and maintained by Apple. The manufacturer's ability to provide security updates and maintain compatibility is therefore dependent in part on the continued availability and support of the relevant macOS operating environment. During the declared security support period, we will make reasonable efforts to investigate and remediate security vulnerabilities affecting the product and, where technically feasible, provide appropriate security updates or workarounds. Where a vulnerability or compatibility issue originates from the operating system or an operating-system component outside our control, remediation may depend on corrective action or continued support being provided by Apple. The availability of the macOS operating environment and the support status of required operating-system components are therefore taken into account when determining and reviewing the product's cybersecurity support period.
CRA Compliance
Where required, products placed on the EU market from 11 December 2027 will undergo the applicable CRA conformity assessment. Where the internal control procedure (Module A) is applicable, conformity is assessed by us as the manufacturer. An EU Declaration of Conformity is issued and the required CE marking is applied. Software products already placed on the EU market before 11 December 2027 are subject to transitional provisions. Continued maintenance, bug fixes, and security updates do not automatically constitute a substantial modification. Substantial modifications made after that date are assessed in accordance with the CRA.
General Cybersecurity Risk Assessment
| Risk | Level | Mitigation |
|---|---|---|
| Malformed or manipulated document | Medium | Input validation, error handling and use of secure system APIs |
| Manipulated software update | Medium | HTTPS, signed updates, macOS code signing and notarization |
| Vulnerability in Sparkle or another dependency | Medium | Maintain component inventory and update affected dependencies |
| Licence-server communication intercepted | Low | HTTPS communication |
| Licence server unavailable | Low | Appropriate error handling; core document data remains local |
| Application package manipulated | Low | Apple Developer ID signing and notarization |
| Local document disclosure | Low | Documents remain under the user's macOS account and file permissions |
Reporting Security Issues
If you believe you have discovered a security vulnerability in one of our products, please use our Contact form. Please provide the product name, version, and a description of the issue.