FAQ

Everything below is answered in more depth somewhere else on this site; each answer says where. Nothing here is a new promise.

Pre-launch

Rendlio Sheets is pre-launch: the first public binaries publish at the M2 launch, and the USD 1,000 offer on the Professional licence is the one on sale today. Anything below that describes a channel or a tier that is not live yet says so in the answer.

The product

What does Rendlio Sheets actually convert?

.xlsx and .xlsm workbooks to PDF, PDF/A-2b (archival PDF), or PNG — one image per page. Every conversion also emits a machine-readable compatibility report naming every deviation from faithful rendering, with locations.

What about .xlsb (Excel Binary) workbooks?

Not supported — and refused up front rather than guessed at. An .xlsb is identified by the content type declared inside the container, not by its file name, so renaming one to .xlsx changes nothing: it is rejected before any of its content is parsed, with a report-coded warning naming both the format and the fix. The result is invalid-input, exit 3, and no document is written at all — nothing is approximated and nothing is half-rendered.

The workaround is a one-time save: open the workbook in Excel, choose File → Save As (or Export), pick Excel Workbook (.xlsx), and convert that file instead.

This is a reasoned no rather than an oversight. Binary workbooks sit where .csv input sits — a demand-gated input-filter candidate, built if documented inbound demand shows up, and never sold as a paid add-on or a separate tier. Until then the refusal above is the whole answer, and it is a documented one: result status and exit codes.

Do I need Excel, Office, or LibreOffice on the host?

No. Rendlio Sheets is a single self-contained binary. No Office, no LibreOffice, no service accounts, no headless browser. See Install.

Does it need network access?

Never, for any purpose. The engine opens no network connection at all — no activation, no telemetry, no font downloads, no phone-home. Licences verify offline by signature against public keys embedded in the binary, which is why an air-gapped host works exactly like a connected one. This is enforced in the codebase by a static analyzer that bans the underlying APIs, not by policy — see the security model.

Does it recalculate formulas?

By default, no — and rendering the stored values is the faithful choice, not a shortcut. When Excel saves an .xlsx it stores, alongside each formula, the value it computed, so --recalculate off reproduces the workbook exactly as Excel last saved it: the numbers on the page are the numbers Excel itself was displaying, and the ones it would have printed. Recomputing them by default would quietly change the document you asked to have reproduced. Strict recalculation (--recalculate=strict-v1) is planned; requesting it in a build that does not have it is a usage error rather than a silent no-op. See the CLI reference.

How do I know the cached values are not stale?

Because staleness is detected and reported, not assumed away. This is the one place converters quietly diverge from the workbook they were handed: some recalculate on their own and return a document that no longer matches the source, others render stale values with nothing to say so. Rendlio Sheets does neither silently — three signals land in the compatibility report:

• W6001 — a formula cell had no cached value to render. The cell renders empty rather than being guessed at, formulas.cachedMissing counts every such cell, and one W6001 names each affected sheet. That is a deficiency in the input file rather than a gap in the engine, and it never passes as clean: the run exits 1 at best.
• W6002 — the workbook itself says its values may be stale. One informational warning, raised when the file asks for a full recalculation on open, or when its stored calculation chain does not agree with the sheets it describes. Nothing on the rendered page changes — the cached values are still exactly what was saved — but the run cannot come back 0, so a pipeline sees the signal without anyone reading a log.
• Volatile and external formulas are recorded. A detection-only scan notes functions whose result depends on when the file is opened, and references reaching into other workbooks. Both render from the cached value as saved, and external data is never refreshed — each one is a report entry with locations rather than a surprise.

The formulas block those counts live in (cellsTotal, cachedMissing, recalcMode, closureSize) and the W6xxx code range are documented on the compatibility report page, which also carries ready-made CI gates — cachedMissing among them.

I generate workbooks programmatically — why are formula cells empty?

Because the generator wrote the formulas without their values. Most libraries that write .xlsx emit the formula string and leave the cached-value slot empty, on the assumption that a spreadsheet application will fill it in the first time the file is opened. Rendlio Sheets never opens one, and in off mode it evaluates nothing itself, so those cells have nothing to render: they come out empty, counted in formulas.cachedMissing and named by W6001.

Two ways to fix it in the pipeline, either of which is a one-time change:

1. Write the computed value alongside the formula. Most .xlsx writers can set a cell’s cached value as well as its formula string — compute the number in your own code and set both.
2. Recalculate the file once before it reaches Rendlio Sheets. Any step that opens the workbook, recalculates it, and saves it again leaves the cached values in place for the conversion.

Either way the check is the same, and it is machine-readable: formulas.cachedMissing back to zero in the compatibility report.

Is the output reproducible?

Yes, deliberately. Add --deterministic and pin --reference-date, and identical input plus identical options produce identical bytes — across platforms and across the four supported architectures. That property is also what makes the fidelity numbers re-runnable.

Can it digitally sign the PDFs it produces?

No — and that is a boundary rather than a gap. Signing is deliberately not coupled to the renderer: where your signing key lives, which policy and timestamp authority apply, and what the audit trail has to look like are decisions your organisation has already made, in infrastructure that is audited on its own terms. A converter is the wrong process to hand a signing key to.

What the conversion contributes instead is the property a signing step actually depends on: the document is reproducible rather than a one-off. With --deterministic and a pinned --reference-date, the same workbook, the same options, and the same build produce byte-identical output, so the bytes you hash and sign can be produced again and compared rather than taken on trust. That makes deterministic output ideal input for the signing infrastructure you already run: sign downstream, in the step that already holds the key. The rules behind the guarantee are on the fidelity methodology page, and both options are documented in the CLI reference.

How do I know what it got wrong?

That is the whole point of the report. Every run prints a one-screen summary to stderr and, with --report, writes the full JSON. unsupported, approximated, and skipped entries each carry a status, a count, locations, and a plain-language detail — and the process exit code is the report’s verdict as a number, so CI can gate on it without parsing anything. Recipes are on the compatibility report page.

Can I try it without installing anything?

Yes — the playground converts a workbook in the browser with no account, using the shipping engine in watermark mode. Files and results are deleted within one hour, and diagnose-only privacy mode analyses structure without rendering cell contents at all.

Is there a published fidelity percentage?

No, and there will not be one. Fidelity is evidenced feature by feature in the compatibility report and in per-area scores on the fidelity page; a single headline figure would depend entirely on which features you weighted. The reasoning, and the rules on what may be published at all, are on the fidelity methodology page.

Free libraries and free alternatives

Why not just use a free library end-to-end?

Because “end to end” is two jobs, and only one of them is ours. Building the workbook — writing rows, filling a template, streaming a few hundred thousand cells without holding them all in memory — is genuinely solved by free .NET libraries, and solved well. We do not compete with them there, and we would rather say so than imply the whole pipeline needs paying for.

The second job is rendering that workbook the way Excel would print it, and then being able to show that it did. That is where Rendlio Sheets sits: every conversion is scored against Excel’s own print output as the oracle, and every conversion emits a machine-readable compatibility report naming each deviation with its location, plus an exit code a pipeline can gate on. Nothing is silently approximated.

So the usual shape is both rather than either: a free library fills the workbook, Rendlio Sheets renders it. One dependency for authoring, one for the print-faithful PDF and the report that comes with it.

Which free libraries should I use to build the workbook?

The ones the .NET ecosystem already reaches for — for that half of the job they are the right answer:

• ClosedXML — a workbook object model for creating and editing .xlsx in code.
• ClosedXML.Report — template-driven reporting: an Excel file with placeholders, filled from your data.
• MiniExcel — streaming reads and writes for large sheets, without materialising the whole workbook.

Keep whichever one you already use, and convert its output. Two things are worth knowing before you do:

• Most writers emit formula strings without their cached values, so those cells render empty rather than guessed at — that is counted and named for you, and the fix is a one-time change: see why formula cells come out empty.
• The playground converts a workbook in the browser with no account, which is the quickest way to see what the report says about your own generator’s output.

Free .NET libraries convert to PDF now. What is left to pay for?

Correctness you can demonstrate — not the ability to convert at all.

The free baseline really has moved, and it moved in-process for .NET: MiniPdf, OfficeIMO.Excel.Pdf, and office2pdf are real free options you can add as a package and call directly, alongside the routes that were already there — a containerised headless LibreOffice service such as Gotenberg, or Syncfusion’s Community licence if you fit its published gate. If one of them produces the document you need, use it. That is a real answer, and not one we are going to argue with.

What a licence buys is a different property, and it is the only one we claim: the output is measured against Excel’s own print of the same workbook under a rubric fixed before the run, and every conversion hands back a report naming what it could not reproduce faithfully. So the question worth asking of any converter, free or paid, is not can it emit a PDF — more and more of them can. It is can it tell you where it diverged, per file, in something a build can read without a human comparing pages.

Which makes the honest path a sequence rather than a choice: prototype free, and upgrade when the output has to match Excel. The point to pay is the point where a wrong page is expensive — an invoice, a customer statement, an archival PDF/A — and not before. We publish no aggregate fidelity figure that would let you make that call from a number, so make it from evidence instead: convert your own workbook in the playground and read what the report says.

Licensing and price

Reflects counsel-review drafts

The exact licence wording behind the answers below — the revenue test, the competing-offering definition, and the community self-certification text — is drafted for review by Swiss counsel and is not yet operative. The licensing guide carries the same caveat and the full detail; once issued, the LICENSE file in the engine repository and the terms presented at checkout are the authoritative texts.

Do I need a licence to evaluate it?

No. Without a licence Rendlio Sheets converts with full features and identical fidelity — every output page just carries a diagonal evaluation watermark, and the run emits W9001 so watermarked conversions exit 1 at best and never 0. There is deliberately no feature-crippled tier. Want to evaluate watermark-free? Request a 30-day trial (business email required).

What does “per legal entity” actually mean?

One licence covers one legal entity — every developer, server, CI runner, and internal product inside it. There are no seat tiers, headcount bands, or per-server counts anywhere in the price list. Enterprise widens the unit to a corporate group: the parent and its named affiliates are covered by one licence, listed in the licence file itself. Full detail: Licensing guide.

Is there a free tier?

Yes — Community, free, for any entity under USD 1M annual revenue, self-certified, that is not offering conversion itself as a service to third parties. It is the same test as the source licence’s production grant, worded the same way, so you cannot satisfy one and fail the other. Note that even the free tier needs a minted licence file; minting is self-serve and takes a minute. Which tier am I?

What do “SaaS” and “OEM” included mean?

You may run Rendlio Sheets inside your own SaaS and ship it embedded (OEM) in your product, at no extra fee — the licence price is the whole price. One boundary: building a product whose main job is conversion itself (a third-party converter) requires the Enterprise licence, which carries that right explicitly. See pricing and the licensing guide.

What happens after my 12 months of updates run out?

Nothing stops working. Your licence is perpetual: maintenance_until gates which builds it covers, not whether it works. Every build released on or before that date is covered forever; a newer build runs in evaluation mode until you renew. Renewal is a one-time purchase at 40% of the then-current list price, whenever you choose — reminders at T-60/30/7 by email, never an auto-charge. See the perpetual fallback.

Why can I not buy Professional at list price or Enterprise today?

Because the engine is pre-launch, and we do not sell what has not shipped. Both go on sale at GA at exactly the prices published on the pricing page, locked from day one. What is on sale now is the Professional licence itself, at the temporary USD 1,000 price — the same licence, at a temporary discount.

Is the USD 1,000 price permanent?

No. The USD 1,000 price is a temporary discount on the Professional licence (list price USD 1,499), limited to 20 legal entities. When those are sold, the USD 1,199 offer opens at a price already published. Either way you buy the full Professional licence — nothing to re-buy later. If the product is ever discontinued before your 12 months of updates end, the offer terms give you the choice of a full refund or keeping the licence, the last release, and a copy of the source code.

What is the refund policy?

30-day money-back, handled by Paddle — the policy. One honest consequence of the zero-phone-home architecture: we cannot reach into your machines to disable anything, so a refund marks the licence revoked in our records and the terms oblige you to stop using it.

Who is the seller?

The Purpose Source Association, a Swiss association; Rendlio is a brand and activity of it. Paddle.com acts as merchant of record and handles payment, VAT, and invoicing — enter your VAT ID at checkout for reverse-charge invoicing. More on the association page.

Is the source code available?

Yes — the engine’s source is published under the Business Source License 1.1. Anyone may read, copy, modify, redistribute, and make non-production use of it without any revenue condition, and each released version’s licence automatically becomes Apache 2.0 four years after its release. The fenced-off uses are hosted conversion services and redistribution to third-party developers. Plain-words summary: Licensing guide.

Running it

How do I gate a CI pipeline on a conversion?

On the exit code, which is the report’s verdict: 0 clean, 1 rendered with warnings, 2 unsupported content, 3/4/5 failures. Most pipelines treat <= 1 as pass and 2 as review. Ready-made GitHub Actions and GitLab CI jobs, including the set +e handling Actions needs, are on the Deployment page.

Is it safe to point at files I do not trust?

That is the design assumption. The engine treats every workbook as hostile: guarded container and XML parsing, decompression-bomb caps, a hard rejection of encrypted containers, macros never executed, images bounds-checked before decode, and a timeout and memory cap you set. For an upload path, add the RENDLIO_SANDBOX=1 hardening profile and a hard container limit. Full contract: security model.

Can it convert a password-protected workbook?

No — it is refused by design, before any of its content is parsed. An encrypted container is identified from its own bytes rather than from its file name, and the run stops there: W1002, a result of invalid-input, exit 3, and no document written at all. The message says exactly that: “password-protected workbook; Rendlio Sheets cannot open encrypted files — remove the password in Excel and retry”. Nothing is guessed at, and no password is asked for.

The workaround is the one that message names, and it is a one-time change you make with the password you already hold: open the workbook in Excel, choose File → Info → Protect Workbook → Encrypt with Password, clear the password box, save, and convert the decrypted copy.

That split is deliberate. Rendlio Sheets never accepts or holds a workbook password — not on the command line, and not in the playground, which refuses password-protected uploads for the same reason. Decrypting a protected workbook is one of the things the engine never does, alongside executing macros and refreshing external data — your password stays on your side of that line.

The refusal is machine-readable too, which is what makes it usable in a pipeline: invalid-input and its exit code come off the result-status ladder, and W1002 sits in the W1xxx parse range of the W-code table — so an encrypted input is distinguishable from a rendering failure without anyone reading a log.

Can a limit hit leave me a half-written PDF?

No. Documents are written to a temp name and atomically renamed only after the whole document is written; on any failure the temp files are deleted, the run exits 4, and the report is still written naming the limit that fired and its measured value. You never gate on a truncated document.

Can I share a report with support if the workbook is confidential?

Yes. Reports never contain cell contents — detail and message strings are static templates plus counts and locations, and a CI leak test enforces it. rendlio sheets diagnose produces the same report without rendering or writing any document at all. See diagnose mode and privacy.

A font in my workbook is not installed. What happens?

Rendlio Sheets uses its bundled fonts by default — deterministic on every host — and records every substitution in the report as requested → used with a reason, plus a warning that layout may shift. Point it at your own corporate fonts with --fonts-dir or RENDLIO_FONTS_DIR, or add OS fonts with --use-system-fonts (off by default, for determinism). You can gate CI on fonts.substitutions being empty.

Which platforms are supported?

win-x64, linux-x64, linux-arm64, and osx-arm64 as self-contained archives; a .NET global tool for hosts with the .NET 10 SDK; and one container image that runs on x64 and ARM64. Deterministic output is byte-identical across all of them. See Install.

How do I report a security issue?

Email security@rendlio.com with the version, the platform, and a reproducing workbook if you have one. See reporting a vulnerability.

Still unanswered?

Email hello@rendlio.com. If the question turns out to be a documentation gap rather than a one-off, it lands on this page.

Next steps

• Quickstart — first faithful PDF plus report, in five minutes
• Install — every channel, and how to verify a release
• Licensing guide — the tier table and the licence file
• Security model — hostile-file handling, end to end