Enterprise document workflows carry legal weight. A contract delivered without proper access controls or an invoice that can be trivially modified creates real business risk. This post covers the four security pillars REFRACT PDF is built around.
1. Encryption at Rest and in Transit
Every PDF generated by REFRACT PDF is:
- Encrypted in transit (TLS 1.2 or later) between your Power Automate flow and the REFRACT PDF API
- Encrypted at rest when stored in Azure Blob Storage (AES-256, Microsoft-managed keys or your own CMK)
If you're in a regulated industry, enable Customer-Managed Keys (CMK) in the Azure portal and point REFRACT PDF's storage account at your Key Vault instance.
2. Password Protection and Permissions
REFRACT PDF supports PDF owner and user passwords with granular permission flags:
{
"security": {
"userPassword": "{{env.PDF_PASSWORD}}",
"ownerPassword": "{{env.OWNER_PASSWORD}}",
"permissions": {
"printing": "high-resolution",
"copying": false,
"modifying": false,
"annotating": false
}
}
}
Never hardcode passwords in template definitions. Use environment variables injected at generation time from your vault (Azure Key Vault or Power Platform environment variables).
3. Dynamic Watermarking
Watermarks serve two purposes: discouraging unauthorised sharing and identifying the original recipient if a document leaks.
REFRACT PDF's watermark section supports dynamic content from the payload:
{
"watermark": {
"text": "CONFIDENTIAL — {{recipient.name}}",
"opacity": 0.08,
"angle": -45,
"fontSize": 48,
"color": "#FF0000"
}
}
This embeds the recipient's name directly into every page — making leaked documents traceable back to the source.
4. Audit Logs
A searchable, tamper-evident audit log is non-negotiable for compliance. REFRACT PDF writes a structured log entry for every generation event:
| Field | Description |
|---|---|
| document_id | UUID of the generated PDF |
| template_id | Template identifier and semver |
| triggered_by | Azure AD object ID of the requesting user |
| payload_hash | SHA-256 of the generation payload |
| generated_at | UTC timestamp |
| delivery_target | SharePoint URL, email, or API response |
These records are stored in Dataverse and can be exported to Azure Monitor or a SIEM of your choice.
Summary
Security in document workflows isn't a single toggle — it's a combination of encryption, access control, traceability, and audit governance. REFRACT PDF bakes all four into the platform so you can focus on building workflows rather than re-implementing security primitives.
Explore the security architecture docs for the full technical reference.