Responsibility and security

A white-label delivery gives you freedom in design and process, but doesn’t let you keep a second version of the document — in JavaScript or in extension code.

What you’re responsible for	What SumDoc is responsible for	Agreed jointly
Brand, navigation, document card	The Rust core: the model, layout, scene, writing to file	Capability profile and command set
Users, sign-in, roles	Surface lifecycle and document events	Security requirements and logging
Storage, versions, retention periods, audit	The supported part of the DOCX format	Formats, file sizes, the document set for acceptance
Adjacent systems and processes	Explicit refusals and protection against edits on a stale revision	Packaging, updates, version support period, availability commitments
Product distribution	Build provenance and contract version	Pilot process and support model

What you can change under your brand

The name, logo, external navigation, theme, interface language, read-only mode, permitted styling variables, visibility of agreed commands, help, and your application’s industry-specific panels.

Forbidden shortcuts

• Writing directly to the document file from the surface.
• Trying to change the document by editing what is drawn on the screen.
• Passing off the desktop app’s internal channels as a public interface.
• Accessing the network or reading files without a declared capability.
• Writing passes, document content, or secrets to the log.
• A silent workaround that changes the meaning of the result.

Minimal security model

• The editor service listens only on the local address — it can’t be reached from outside.
• Every launch creates a new random 256-bit pass on its own, and it is valid for exactly as long as the surface itself runs. You can set your own pass too — then rotating it on every launch and the strength of the value are on you: the core rejects only an empty string.
• Documents don’t leave your perimeter until you connect an external service yourself.
• An error arrives as an explicit refusal with a reason, and a change never leaves a half-written file.
• The production delivery fixes checksums, the version, platform, and architecture, the vulnerability handling process, and the update rules.

An honest promise

The phrase “supports DOCX” isn’t enough: it promises nothing. Agree instead on a capability matrix, where for each “format and feature” pair it states what’s read, what’s written, what round-trips without loss, on which platforms, and with what limits.

Next

• How this is verified before the contract — Pilot and acceptance.
• What’s customizable under your brand — Customizing under your brand.