Doconut is a .NET library you host yourself, not a document service you upload to. Files are opened, rendered and served entirely inside your own infrastructure — which is what makes it viable for regulated workloads where the document itself can never cross an organizational boundary.
Your infrastructure — trust boundary
Your application
Reads the file from wherever it already lives: local disk, a network share, S3, Azure Blob, a database column.
Doconut middleware
Registered in your own pipeline with AddDoconut() and UseDoconut(). Runs in your process, under your identity, in your network.
Page images
Viewer.OpenDocumentAsync() renders paginated page images and returns an opaque session token. The source file is never handed to the browser.
The browser
The JavaScript widget requests pages by session token from your own endpoint. It never sees a file path, a storage URL, or the original bytes.
Never contacted while rendering
Architecture
A hosted viewer service works by receiving your file. Doconut works by never receiving it. The document is read by your own process, rasterized into page images by your own process, and streamed to the browser by your own process — Doconut is the library doing the work, not a party to the transfer.
Security model
There is no SaaS mode and no hosted fallback. Doconut ships as DLLs you reference; if your servers are offline, rendering still works. The absence of an upload path is a property of the architecture, not a configuration setting somebody can flip.
OpenDocumentAsync() returns an opaque string, not a file path or an identifier the client can tamper with. The browser cannot enumerate documents, guess a neighbouring token, or rewrite a token into a different file. Treat tokens as secrets: never log them and never persist them client-side beyond the viewer.
Doconut never decides who may read a document. You call OpenDocumentAsync() only after your own authorization check has passed, so the viewer inherits whatever access control your application already enforces — roles, tenancy, record-level permissions, all of it.
The browser receives rendered page images, not the source document. A user who can view a contract cannot trivially exfiltrate the original DOCX, and a leaked page image does not carry the tracked changes, comments, hidden columns or metadata the source file did.
Encrypted and password-protected files are opened server-side with the password supplied by your code. The password crosses process boundaries only inside your own application — never to the client, never to us.
Licensing is a local .lic file resolved through options.LicensePath or Viewer.DoconutLicense(path). There is no activation callback and no runtime licence check over the network, which is what makes air-gapped deployment possible at all.
Compliance
An honest framing matters more here than a wall of logos. Doconut is a library, not a service provider. We never receive, store or process your documents, which means we do not become a processor, a sub-processor or a business associate when you deploy it. That removes an entire category of paperwork — but the controls around the deployment remain yours to operate and evidence.
Because protected health information never reaches Doconut, there is no business associate relationship to paper over with a BAA. Records and DICOM studies are rendered inside your own environment. The safeguards themselves — access control, audit logging, encryption at rest and in transit — remain your responsibility, exercised in the application you already run.
Personal data stays wherever you put it. There is no cross-border transfer introduced by the viewer, because there is no transfer at all: the document is read and rendered in the same jurisdiction as the server you deployed to. Residency becomes a hosting decision, not a vendor negotiation.
Deployments with no outbound internet access are a supported configuration rather than a workaround. Package the DLLs and the .lic file, install into the enclave, and the viewer runs indefinitely for the version range the licence covers.
Doconut does not advertise SOC 2, ISO 27001 or HITRUST certification, and you should not represent it as certified. The security argument is architectural: the vendor is never in the data path. If your auditor needs a control narrative, that is the narrative.
Deployment
The classic target. IIS or Kestrel, in your own data centre or on a cloud VM you control.
Supported for .NET 8. Ship the viewer as part of your own image and keep licence files out of the layer with a mounted secret.
Multiple nodes behind a load balancer share the render cache, so a session opened on one node stays readable on another.
No outbound connectivity required at any point after installation — not for rendering, not for conversion, not for licensing.
Operations
None of these are exotic. They are the handful of things that most often go wrong in a real deployment, in the order they usually bite.
No. Doconut is a library that runs inside your application. There is no upload endpoint, no hosted rendering tier and no telemetry channel that carries document content. If your server has no route to the internet, the viewer still renders normally.
Not through the viewer. The browser receives rendered page images addressed by an opaque session token. If you want a download button, you implement it yourself — which means the decision to release the source file stays an explicit choice in your own code.
An opaque string returned by Viewer.OpenDocumentAsync() that the JavaScript widget presents to fetch pages. It is not a document identifier, not a path, and not something to store or reuse. Treat it like a bearer credential with a short life.
No. Licensing resolves a local .lic file. There is no activation call and no periodic revalidation, which is precisely why air-gapped installations work.
Yes. Rendering, conversion and licensing are all local. The only thing an internet connection buys you is downloading updates, which you can equally carry in on media.
We do not claim either, and you should not represent the product as certified. The relevant fact for an audit is different and usually stronger: Doconut is never in the data path, so there is no vendor environment for an auditor to assess in the first place.
Your code supplies the password when opening the document, server-side. It is used to decrypt in your own process and is never transmitted to the browser or anywhere else.
Request a temporary licence and run Doconut on your own infrastructure, against your own documents, with your own firewall rules in place. That is the only evaluation that proves the point.
100% rendering on your own servers