Write-back of redacted PDFs

Write-back is off by default on every connector. Production write-back stays off until DMS write-back certification is turned on under Settings → Modules, a sandbox run has passed, an organization admin has signed off, and the connector has a sandbox root (folder, case, S3 prefix, or Datasite fileroom).

Sandbox write-back certification is a separate optional module. An organization admin enables it under Settings → Modules. It shares the connectors entitlement. Firm may enable it for SharePoint. iManage, HighQ, ESDH, and the rest of the catalog need Trial or Enterprise.

When it fires: after a document reaches completed (apply finished and verification passed), Northdocs either uploads {originalBase}_redacted.pdf to the configured write-back folder or creates a native version on the imported source document.

Naming is always PDF even if the source was DOCX/XLSX. The redacted artifact is the PDF output of the pipeline.

Native version mode is safe only when the imported source item is already a PDF. Northdocs refuses to put PDF bytes into an Office or other non-PDF source item and directs you to create a new file instead.

Every upload is read back from the provider. Northdocs compares the local and remote SHA-256 hashes and marks the write-back failed if they differ. Status, remote version metadata, and both hashes are retained in the document audit metadata.

Sandbox checklist before production: (1) connect to a non-client folder, (2) select create-new or native-version certification mode, (3) run Write-back certification on the connector card, (4) confirm SHA-256 verified, (5) download the JSON evidence and have an organization admin sign off. The certification destination must sit inside the pinned sandbox root. The certification mode applies only to that run and does not change production settings.

On iManage and HighQ, changing the sandbox root folder after admin sign-off pauses production write-back until you complete a new certification run that started after that change and sign off again. A run that was already in flight against the previous pin cannot lift the freeze. Restoring the previous folder id does not resume write-back. SharePoint, S3, and ESDH sandbox edits do not freeze Diligence.

If write-back fails because the destination sits outside the certified sandbox folder tree, Northdocs says to choose a folder inside the signed-off sandbox, or re-certify. Browse and import still hide whether an out-of-scope item exists.

Recorded certification workflows are available for iManage, HighQ, Microsoft Graph, and Danish ESDH connectors. Each run preserves provider, mode, remote id, hashes, timestamps, outcome, and customer sign-off.

To disable: turn write-back off on the connector. In-flight jobs may still finish; new completions will not upload.

Never point write-back at a production client site until naming, folder scope, and retention on the DMS side are agreed.