Does UniPDF send my documents anywhere?

No. UniPDF is a library, not a service. Parsing, rendering, extraction and writing all happen inside your own process, so document content is never uploaded, never queued and never stored anywhere outside the machine running the code. There is no conversion endpoint to send a file to.

The content never crosses your network boundary, so it never lands in a third party’s logs, caches or backups.

Three features do reach the network, and one of them sends document content. All three are opt-in.

What the license check transmits

A metered API key makes an outbound call to the UniDoc license server. The payload carries:

It does not carry document content, page text or filenames.

By default usage is cached and reported periodically. license.SetMeteredKeyPersistentCache(false) reports immediately instead, which is what you want where there is no writable persistent storage. The cache location follows UNIDOC_LICENSE_DIR, defaulting to the home directory, which is worth setting explicitly in a container or under a service account with no home.

An offline license removes this call entirely. It is verified from its own signature and makes no network connection at all, which is why it exists for air-gapped and OEM deployments.

OCR sends image data to a service you choose

This is the one feature that transmits document content.

UniPDF does not recognize text in images itself. The ocr package is an HTTP client: it packs an image into a multipart form, posts it to a URL you configure, and hands back the response unchanged. The recognition happens in whatever service sits at that URL.

That service is yours. Nothing is sent unless you set a URL and call the package, and where you point it is entirely your decision, so running the OCR service inside your own network keeps the images there too. Point it at a third-party cloud OCR API and the page images go to that third party, on their terms rather than ours.

If you do not use the ocr package, no image data leaves the process.

Signatures reach the network, but send only hashes and identifiers

Three parts of the signature workflow can make outbound requests. None of them sends the document.

Timestamping. A PAdES B-T signature contacts the timestamp authority you set with SetTimestampServerURL. The request is an RFC 3161 message imprint, which in UniPDF is a SHA-512 hash of the signed data. The authority receives that hash and returns a signed token; it never sees the document, and cannot reconstruct it from the hash.

Revocation data for LTV. Building an LTV-enabled signature fetches certificate revocation information over OCSP and CRL, and downloads any issuer certificate the chain is missing from the address in the certificate’s Authority Information Access entry. Those requests go to URLs published inside the certificates themselves, meaning the issuing certificate authority’s servers, not UniDoc’s. They carry certificate identifiers, not document data. UniPDF logs and continues when a request fails rather than aborting.

Signature validation. Validating a signature makes no connection by default. ValidateSignatures, and ValidateSignaturesWithOpts with Revocation unset or set to RevocationCheckOffline, use only the trust roots you supply and the revocation data already embedded in the document. With RevocationCheckOnline, for each certificate in the signer’s chain, and in the timestamp authority’s, that the embedded data does not settle, UniPDF queries the OCSP responder named in the certificate and, if that does not settle it, downloads the CRL, over HTTP or HTTPS, through HTTP clients you can supply. A CRL fetch is a plain download of that URL. An OCSP request carries the certificate’s serial number and hashes of its issuer’s name and public key. Neither carries document content, page text or filenames. The requests go to the certificate authority, so it learns that one of its certificates is being checked, not which document it signed. See Validating Signer Trust and Revocation.

All three are opt-in: a plain signature with no timestamp and no LTV, validated without online revocation checks, makes no network call.

Running with no outbound connections at all

For an air-gapped deployment, or where a compliance rule forbids egress:

• Use an offline license rather than a metered API key.
• Do not use the ocr package, or point it at a service on your own network.
• Sign without a timestamp and without LTV, or supply revocation data yourself rather than letting it be fetched.
• Validate signatures with revocation checks off or offline, never RevocationCheckOnline.

With those, UniPDF makes no outbound connection.

What this is not

Keeping content on your machine is not the same as securing the file. UniPDF has real encryption for that, which is a separate question with its own answers: locking a document with a password and opening an encrypted one.

Your license key is a credential. Read it from an environment variable or a secret store rather than committing it, since anyone holding it can spend your credits.