# Security Overview

> Where a Windows Forms app processes documents, what TextControl protection, PDF passwords and signatures cover, and what your own code must decide.

- **Product:** TX Text Control .NET for Windows Forms
- **Section:** Documentation
- **Kind:** Topic
- **Path:** TX Text Control .NET for Windows Forms > Security > Security Overview
- **1493 words**
- **Web URL:** https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/overview/
- **LLMs URL:** https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/overview/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/overview/llms-full.txt

---

A Windows Forms application with TX Text Control opens, edits and saves documents on the computer of the person who uses it. That decides most security questions: the documents, the templates and any certificate for signing are on that computer, and the user has access to them. TX Text Control adds protections that are part of the documents themselves, and your application decides who may use them and how. The sections below describe this model for developers who plan such an application and for the people who review it.

### Where Documents Are Processed

Every part of TX Text Control .NET for Windows Forms runs inside your application:

- **`TextControl`**, the editor on the form, and **`ServerTextControl`** and **`MailMerge`**, which work with documents in code, run in the process of your application, as [Product Architecture](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/overview/architecture/llms-full.txt) describes.
- **The document engine** consists of .NET assemblies and native Windows libraries that are installed with your application. They load, format, render, print and save the documents.
- **The license** is compiled into your assembly when you build it. There is no activation and no license server, and the users of your application need no license of their own, as [Application Licensing](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/licensing/application/llms-full.txt) explains.

A document isn't stored anywhere until your code or the user saves it. Two features that involve other computers depend on your code:

- **Trusted timestamps.** When a [DigitalSignature](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/reference/txtextcontrol/digitalsignature/llms-full.txt) names a time server, the signing computer requests a timestamp from that server while it saves the PDF. [Timestamp Configuration](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/digital-signatures/timestamps/llms-full.txt) describes the options.
- **Hypertext links.** Clicking a link in a `TextControl` does nothing until your application handles the [HypertextLinkClicked](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/reference/txtextcontrol/textcontrol/hypertextlinkclicked-event/llms-full.txt) event, so your code decides whether a browser opens. [Handling Untrusted Documents](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/untrusted-documents/#decide-what-a-link-opens) shows a handler.

### What the User's Computer Means for Security

Because the application runs where the user works, the user can reach everything it works with: document files, templates, the application folder and the files it reads at startup. In an article on where to generate documents, Text Control points out that templates stored and processed on the client can be changed by users, and that highly sensitive data is safer when documents are created on a server. Keep this in mind when you decide which files your application installs and which it gets from a protected location, such as a database or a service that checks who asks.

Protection inside a document still helps on the user's computer: it travels with the file, whoever copies it. What each kind of protection does, and what it doesn't, is the subject of the next section.

### What TX Text Control Provides

| Mechanism | What it does | What it doesn't do | Read |
|---|---|---|---|
| Document protection | Restricts editing, formatting, copying and printing in the `TextControl`, except in editable regions | Hide the content: a protected document can still be read | [Document Protection and User Permissions](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/document-protection/llms-full.txt) |
| PDF user password | Encrypts a PDF, so that it opens only with the password | Show whether the document was changed | [PDF Passwords and Permissions](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/pdf-passwords/llms-full.txt) |
| PDF permissions | Tell PDF readers what users may do, such as printing or copying | Stop readers that ignore them; they aren't cryptographic protection | [PDF Passwords and Permissions](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/pdf-passwords/llms-full.txt) |
| Digital signature | Makes changes to a PDF detectable and identifies the signer | Hide the content | [Certificate and Private Key Handling](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/certificates/llms-full.txt) |
| Load settings and events | Decide what the editor imports from a document and what happens when users click links | Check a document for harmful content | [Handling Untrusted Documents](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/untrusted-documents/llms-full.txt) |

The mechanisms combine: a contract can be protected while users fill it in, and then saved as a signed PDF with a password.

### What Your Application Decides

TX Text Control provides the mechanisms, and your code decides when they apply:

- **Who the user is.** The names in [UserNames](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/reference/txtextcontrol/textcontrol/usernames-property/llms-full.txt) decide which editable regions a user may change, and TX Text Control doesn't check them. Your application sets them from its own sign-in.
- **Where passwords come from.** Your code passes the passwords of PDF documents and protected documents, and it asks the user for them when a document needs one.
- **Which certificate signs.** A signature is created with the certificate your code passes; where the certificate and its private key are kept is up to your application.
- **What a document may do in the editor.** The permissions of a PDF you open are applied by your application, not by the `TextControl`, as [Respect the Permissions of a PDF](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/pdf-passwords/#respect-the-permissions-of-a-pdf) shows.

The license agreement puts the responsibility for the whole application with you: the licensee determines whether the application and its use of TX Text Control are subject to security, privacy or other regulatory requirements.

### The Software Supply Chain

- **Packages.** In .NET projects, `TXTextControl.TextControl.WinForms.SDK` comes from Text Control Offline Packages, installed by the setup, or from the Text Control Private NuGet Feed, which authenticates you with your email address and an API token. [Configuring Package Sources](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/nuget/sources/llms-full.txt) describes both.
- **What must not ship.** The license agreement forbids giving users your serial numbers, the license file *txtextcontrol.winforms.license* or your *nuget.config* with its API token. [Secure Application Deployment](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/deployment/llms-full.txt) lists the checks for a release.
- **Dependencies.** For the NuGet packages of version 34.0 and later, including `TXTextControl.TextControl.WinForms.SDK`, Text Control provides signed SBOMs (software bills of materials) that list the components of each package, as [Secure Application Deployment](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/deployment/#check-the-components-you-ship) describes.

### Next Steps

- [Document Protection and User Permissions](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/document-protection/llms-full.txt): what protected documents and editable regions guard against.
- [Handling Untrusted Documents](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/untrusted-documents/llms-full.txt): open documents from other people safely.
- [PDF Passwords and Permissions](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/pdf-passwords/llms-full.txt): encrypt PDF documents and respect the permissions of others.
- [Secure Application Deployment](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/deployment/llms-full.txt): the checks before your application ships.

---

## Nearby

- **Previous:** [Security](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/llms-full.txt)
- **Next:** [Document Protection and User Permissions](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/document-protection/llms-full.txt)