A Word file can carry macros, a remote template, a field that pulls content from a server, or an image that phones home the moment it is opened. A PDF can carry JavaScript, an open action, a launch command or an embedded file. DISARM rewrites the document without those parts and lists what it took out. The text, formatting and pictures stay. Runs in this tab. Included in the Sovereign Pass.
PDF, and Office files in the modern formats: .docx .xlsx .pptx and their macro-enabled variants (.docm .xlsm .pptm), which are written back as the plain format.
The list appears here after a file is processed.
Office files. VBA macro projects and their signatures, ActiveX controls, Excel 4.0 macro sheets, embedded OLE objects and executables, attached-template references, DDE and DDEAUTO fields, INCLUDEPICTURE and INCLUDETEXT fields, and any image, object, frame or data connection that loads from an external address. A macro-enabled file comes back as the ordinary format so it cannot carry macros again by accident.
PDFs. Document-level JavaScript, the open action, page and document actions, launch, submit-form, import-data and remote go-to actions, embedded files, file attachment and rich media annotations (video, sound, 3D, screen), the XFA form layer, and form field scripts. Web links are kept unless you tick the box.
It is a structural clean. The parts that run code or reach out to a server are removed by rewriting the file. What remains is the document: text, layout, pictures, ordinary links.
It is not antivirus. A file can attack the program that opens it through a malformed font or image, and a rewrite does not look for that. A document can also simply lie in its text. Keep your viewer updated and stay sceptical of the sender.
Forms may stop calculating. Removing form scripts from a PDF removes the calculations and validations too. If you need a fillable form to keep working, do not disarm it; open it somewhere you trust instead.
Old binary formats are not handled. .doc, .xls and .ppt are a different container. Save them in the modern format first.
Nothing leaves this tab. The file is read and rewritten in browser memory. Read the removal list; it tells you what the sender put in.