Skip to content

Office Online Server support ends 31 Dec 2026: 67 days left. Read the migration guide →

Office Render Engine
Book a demo

Security & architecture

For IT security and procurement reviewers: how Office Render Engine runs in your network, what it touches, and what it refuses to do.

Deployment architecture

Office Render Engine runs on a Windows Server inside your network. SharePoint Server SE calls it over WOPI, exactly as it called Office Online Server. It has no connection to the internet or to any cloud service: no telemetry, no licence check, no phone-home.

User browser

CUSTOMER NETWORK

SharePoint Server SE

WOPI host

WOPI · signed requests

Office Render Engine

WOPI client and cache

Loopback · mutual TLS

Isolated LibreOffice process

The browser opens a document through SharePoint. SharePoint and Office Render Engine exchange WOPI requests. An isolated LibreOffice process renders the document inside the customer network.

Data flow

  1. A user opens a document in SharePoint. SharePoint sends the browser to Office Render Engine with a WOPI access token.
  2. Office Render Engine validates the request's WOPI proof-key signature, then fetches the file from SharePoint with that token.
  3. The file is rendered by an isolated rendering process, reachable only on loopback with mutual TLS.
  4. The preview is cached on the server's local disk, for at most seven days and within a size limit (20 GB by default). Each entry is tied to the document version and the renderer version, and every cached view still requires a fresh permission check with SharePoint using the user's own token. Cached previews are not encrypted by Office Render Engine; use BitLocker on the cache volume if your policy requires encryption at rest.

Hardening

  • Macros are never executed, and neither is anything else a document asks for: macro security at its highest setting, macro execution disabled, Java disabled, remote link resolution blocked.
  • PDFs with JavaScript, auto-open actions or attachments are rebuilt from their pages before they are shown. PDFs without active content are served byte for byte.
  • Oversized and zip-bomb documents are refused, not expanded: source files above 300 MB, previews above 50 MB or 5,000 pages, or archives expanding more than 200:1 are offered as a download instead. All ceilings are configurable.
  • Password-protected documents are not previewed.

Authentication

NTLM, Kerberos, claims / AD FS, anonymous guest viewing and token-expiry recovery are each approved for deployment only after a live SharePoint SE test is recorded. Status as of October 2026: all five are implemented and viewing is tested over HTTPS on our SharePoint SE lab farm; validation of each context on customer-like farms is in progress. We confirm your authentication setup with you before a pilot.

Open source and licences

Documents are rendered by a pinned, hardened build of LibreOffice (MPL-2.0), running isolated on your own server. We keep LibreOffice's licence notices and publish any changes we make to its source.

A full software bill of materials (SBOM) is available on request.

Reporting a vulnerability

Please report vulnerabilities to info@aurum-consulting.de with “Office Render Engine security” in the subject. Our security.txt lists the details.