# Protected PDF Renditions

In addition to [standard PDF viewable document renditions](/en/lr/3815/), Vault supports generation of protected viewable renditions. By default, Vault-generated PDF renditions are unprotected, but using this feature, Admins can configure [rendition profiles](/en/lr/153330/) in their Vault to render password-protected PDF documents.

## Enabling Protected Renditions

To enable protected PDF renditions, navigate to **Admin > Configuration > Rendition Profiles**. Under _Protected PDF_, select **Generate Vault Protected PDFs**. Renditions are then secured with a password randomly generated by Vault. This password is not recoverable, and Vault does not store the passwords.

Once protected renditions are enabled, Vault does not generate standard unprotected PDF renditions except by use of the **Download Non-Protected Rendition** [action][1].

### Protected Renditions for Specific Documents

You can alternately configure a [rendition profile](/en/lr/153330/) to limit protected rendition generation to specific documents. Configuring protected renditions in this way allows Vault to continue generating unprotected renditions for other documents.

### Rendition Security Settings

By default, you can't print, edit, or copy content when protected PDF renditions are enabled. You can modify the following settings in **Admin > Configuration > Rendition Profiles** to determine the level of editing allowed on protected renditions:

PDF Printing Settings
: _None_; _Lo Resolution (150 dpi)_; or _High Resolution_

PDF Edit Settings
: _None_; _Inserting, deleting, and rotating pages_; _Filling in form fields and signing existing signature fields_; or _Commenting, filling in form fields, and signing existing signature fields_

Content Copying Settings
: _None_; _Copying of text, images, and other content_; or _Content copying for accessibility devices only_

## Generating Protected Renditions

To generate a password-protected viewable rendition:

  1. Upload a document.
  2. Classify the document by assigning it a document type, subtype, or classification with protected renditions enabled.
  3. Vault automatically generates a password-protected viewable rendition on download. Vault identifies rendition PDF/A-compliance in the Renditions panel of the Doc Info page.

If Vault fails to apply security settings during rendition generation, your download also fails. You can attempt to download the document again. Vault captures the failed renditions on the [Rendition Status page](/en/lr/66783/).

If you need to edit the protected rendition, you must instead update the source document and re-render.

### Downloading the Non-Protected Version of a Rendition {#downloading-non-protected-action}

Users with the _Document: Download Non-Protected Rendition_ [](/en/lr/22824/) can download an unprotected viewable rendition. By default, this permission is included in the standard _Vault Owner Actions_ and _System Administrator Actions_ permission sets.

To download the unprotected rendition, open the **Document Files** pane in the document viewer and, under _Renditions_, click the **Actions** menu next to the rendition file. Then, select **Download Non-Protected Rendition**.

## Limitations

The following limitations apply to password-protected PDF renditions:

  * Vault does not add password protection to PDF/A compliant renditions.
  * Vault does not apply password protection to PDF source documents with pre-existing security settings. You can still download viewable renditions of previously protected documents.
  * Vault only applies password protection to viewable renditions of CrossLink documents upon download. It does not apply these security settings to the original document in the source Vault.

## Related Permissions

The following permissions control your ability to work with protected renditions:

### Security Profile

Document: Download Rendition
: Controls ability to download renditions of any type, including viewable renditions.

Document: Download Non-Protected Rendition
: Controls ability to download viewable renditions without any configured security settings or protection applied.

Vault Owner Actions: Re-render
: Controls ability to save page rotations, re-render a document, and delete a viewable rendition without the _Manage Viewable Rendition_ document role permission. Users with the Vault Owner security profile do not need to be assigned to any role on the document.

### Document Role

View Content
: Controls ability to view and download renditions of any type, including viewable renditions.

View Document
: Controls ability to view document fields, settings, and metadata.

Edit Fields
: Controls ability to upload and delete renditions of any type other than viewable rendition.

Manage Viewable Rendition
: Controls ability to replace an existing viewable rendition by uploading a file or re-rendering the source file and ability to delete an existing viewable rendition.

[1]: #downloading-non-protected-action