The company behind NextPDF
NextPDF is the open core of a commercial product built by a Taipei security company whose ISMS is certified to ISO/IEC 27001:2022.
A PDF engine sits close to sensitive material: contracts, invoices, signed agreements, and the private keys that sign them. For an open-source library that handles cryptography and legal artifacts, “Who maintains this, and under what discipline?” is a supply-chain question.
The open core of a commercial product
NextPDF is built and maintained by PATEON Network Technology, an independent security and network engineering company based in Taipei, Taiwan. Before its code became open source, the engine spent years as a production product inside the company, serving B2B document workflows where security and compliance were central.
The open-source NextPDF Core is that engine, released under Apache-2.0. NextPDF Pro and NextPDF Enterprise remain PATEON’s proprietary products, and their revenue funds continued maintenance of the open core. Here, commercially validated means the engine spent years processing audit-relevant documents and real signing obligations before its open-source release.
Discipline you can verify
PATEON operates an information-security management system that is independently audited, certified to ISO/IEC 27001:2022, and under active surveillance. The certification covers the company’s ISMS. The registered scope is: “Specializing in information software services, data processing, third-party payment, software wholesale and retail, computer equipment installation and manufacturing, advertising services, management and leasing consulting, and other legally permitted activities, as per the Statement of Applicability Version 1.1 dated 9th August 2024.”
The same discipline makes standards conformance central to the project. It appears in the engine’s API, typed failures, and fail-closed behaviour.
What this means for you
NextPDF Core is the open edition of a commercial product. The company that sells the editions built on it also maintains the open-source engine.
The provenance is verifiable. The engine runs entirely in your process, independent of PATEON’s services. PATEON builds and governs the code; your application processes the documents.