1. IronOCR
2. Troubleshooting
3. IronOCR - Security CVE

IronOCR Security CVE: Keep Your Data Safe

Please see information below regarding IronOCR:

1. All Iron Software products are DigiCert certified.
2. IronOCR does not use web services nor send data across the internet to perform OCR.
3. No COM or COM+ interfaces are exposed in the IronOcr.dll.
4. The library is written in C#, which protects implicitly from many common attack vectors.
5. As few entry points as possible to the API are exposed.
6. Strong naming and sophisticated tamper protection are implemented.
7. The library is regularly scanned with multiple anti-virus and anti-malware scanners, using the highest security and heuristic search for potential threats.
8. Every line of code goes through at least two levels of human review by senior engineers to check for security vulnerabilities.
9. We will disclose that IronOCR will access unmanaged (C++) code:
   
   • tesseract.dll - No direct executable entry point to this DLL is distributed nor exposed.
   • pdfium.dll - No direct executable entry point to this DLL is distributed nor exposed.
   • leptonica.dll - No direct executable entry point to this DLL is distributed nor exposed.
   • imagemagick.dll - No direct executable entry point to this DLL is distributed nor exposed.
10. IronOCR makes use of the following .NET dependencies, none of which are known to us as a security attack vector, particularly as every object is internalized to our library (static linking) with no public or external access: Link
11. ZXing.Net
12. Tesseract.Net
13. PdfiumLight
14. Magick.NET-Q8-AnyCPU
15. LibPdfium
16. PdfiumLight
17. ICSharpCode.SharpZipLib