The Short Version
A person reviews every app before it is listed. We download it from the developer's official source, scan the installer with VirusTotal before opening it, install it (on a clean Windows 11 machine for Windows software), use it long enough to judge it, and write an original listing. We reject apps with no verifiable source, bundled browser extensions, search engine swaps, malware, or permission requests that don't fit the app. New versions go through the same process.
Why We Explain Our Process
A download site can list software without ever installing it. We install each app ourselves, and this page shows how, so you can judge the process for yourself. We have been doing this since 2018.
Our starting position: we assume every installer is potentially problematic until we verify it is not. That is also why our listings sometimes fall behind on version updates: we only publish what we have personally tested.
The Five Steps Every App Goes Through
This applies to every new listing and every version update, with no exceptions for big names. Chrome, VLC, and WinRAR go through the same steps as software nobody has heard of.
-
We find the official source
Before downloading anything, we identify the developer's official website or the canonical distribution channel, such as GitHub releases, the Microsoft Store, or the developer's own CDN. We don't accept files from third-party file-hosting sites, unverified mirrors, or upload submissions.
If an app has no clear, reachable official source, it doesn't get listed. Mirrors often carry a different build from the one the developer shipped.
-
Security scan before anything else
We scan the installer before opening it, never after. It goes through VirusTotal, which checks the file against more than 70 antivirus and threat-detection engines at once, and we cross-check anything ambiguous with other scanners.
If even one engine flags the file, we hold the listing and investigate. Most single-vendor flags on legitimate software are false positives, so we look at what triggered the detection, whether it matches a known false-positive pattern for that vendor, and whether any high-confidence engines agree. If the doubt doesn't resolve cleanly, we don't publish, and detections from two or more high-confidence engines lead to rejection.
-
We install it ourselves
An editor installs the software and goes through the full setup, reading every screen. For Windows apps that means a clean Windows test machine, currently running Windows 11 25H2. We watch for pre-ticked optional installs, browser homepage changes, default search engine swaps, toolbars, and anything else that would be on by default if someone clicked through quickly.
We also check what the uninstaller leaves behind. A program that installs cleanly but scatters orphaned files and registry keys still gets flagged in the review.
-
We use it long enough to form an opinion
For utilities that might be 20 minutes. A video editor or PDF suite takes longer. We are not writing a comprehensive review of every feature. We make sure the software does what it claims, behaves as you would expect, and doesn't contact servers it has no reason to contact.
We also check for permissions that make no sense for the function. A simple file archiver doesn't need your microphone, and if it asks, the listing notes say so.
-
We write the listing from what we saw
Whoever did the install writes the listing. The description covers what the software does, who it is for, its limitations (free version versus paid features, for instance), and any setup behavior worth flagging.
We don't copy the developer's marketing copy. Each listing has at least 150 words of original content.
How Review Works on Each Platform
The five steps apply to every listing, whatever the platform. What changes is the source we start from and the problems we watch for most closely.
| Platform | What we list | Where files come from | What we watch most closely |
|---|---|---|---|
| Windows | Apps and games | The developer's official site, GitHub releases, the Microsoft Store, or the developer's own CDN | Pre-ticked extras, browser and search engine changes, uninstaller leftovers |
| macOS | Apps and games | The developer's official site or canonical distribution channel | Installer extras and permission requests that don't fit what the app does |
| Android | Apps and games | The developer's official site or canonical distribution channel | Permissions that don't fit what the app does |
| OS ISOs | Windows and Linux distributions | The publisher's own download, never an unverified mirror | A clear source, shown in the listing along with where the file is hosted |
Windows is the biggest section of the site, so the examples on this page lean toward Windows installers. The same standards apply to macOS, Android, and OS ISO listings.
What Gets a Listing Rejected or Removed
Rejections happen at step 1 (bad source), step 2 (scan failure), or step 3 (bundled junk in the installer). Removals happen to existing listings when something changes.
- Free version has meaningful feature limits (labeled "Free Trial")
- Optional extras in the installer that are clearly opt-in
- Single-vendor false positive, with an explanation noted
- Older version still listed because the developer removed the offline installer
- Software requires an account to use core features (noted in the listing)
- Portable version differs slightly from the installed version (both linked)
- ARM64 support added in a later build than x64 (both noted)
- Installer bundles a browser extension by default
- Setup changes your default search engine without clear consent
- No verifiable official source exists
- Malware or PUP (potentially unwanted program) detected by 2+ high-confidence engines on VirusTotal
- Software asks for permissions clearly unrelated to its function
- Developer releases an update that introduces bundleware (extra software packaged into the installer)
- Uninstaller leaves significant junk behind with no clean-up option
- Abandonware with active, known security vulnerabilities
How Updates Work
When a developer releases a new version, we run the same process as for a new listing. A new version of safe software isn't automatically safe. Updates are a common way legitimate apps pick up problems: a developer gets acquired, monetization pressure rises, and suddenly version 8.0 has a toolbar that 7.9 didn't.
We monitor release notes for apps in the catalog and re-test before updating the listed version when something significant changes.
For apps that update often, such as browsers, we run a lighter check on a minor security patch from a source we have already verified. A major version jump, or release notes that mention changes to installation or bundled components, gets a full check.
If a new version brings in something we can't accept, the listing stays on the previous version with a note explaining why, until the developer fixes it. If we find no clean path forward, we remove the listing.
Money and Editorial Independence
GramFile doesn't earn money from download counts, software sales, or commissions tied to which apps we feature. A developer can't pay to get listed, to get a "top pick" badge, or to have a negative note removed. The Editor's Picks section on the homepage reflects what our team finds useful and well made, not which developers have a marketing budget.
We run display advertising to cover the site's costs. Advertisers have no influence over editorial decisions, and ads can't appear on download pages in a way that mimics or hides the download button. We have turned down advertising arrangements that required changing how we present listings, and we will keep doing so. The full rules are in our editorial policy.
Who Does the Reviewing
Reviews are written by the GramFile editorial team. Dr. Mohamed Zaki, who founded the site, sets its technical direction and has the final say on what gets published. Ahmed Madbouli tests software and checks each app against what the developer promises. Ali Mohamed checks what a program actually does, and Eman Sakr reviews interface quality and usability.
Each reviewer on the wider team covers one area, such as productivity, security, media, or games, so they know that category well.
We Get Things Wrong Sometimes
A developer can clean up an installer without changing the version number. A security vendor can fix a false positive that had us holding a listing. We can also miss something in testing, especially in software with deep feature sets.
A listing also reflects the version we tested on the day we tested it. No scan or hands-on review can promise that an app stays safe through every later update, which is why we re-test when a version changes significantly.
When that happens, we want to hear about it. If something you install from GramFile behaves differently from our listing, such as a bundled extra we missed or a version mismatch, please tell us. Those reports come from people who ran the software on a real machine in a real environment, which sometimes catches things our test setup doesn't.
Use the Report a Problem page. It goes directly to the editorial team, not a general inbox. For anything else, use the contact page. We read every message, though reply time varies with volume.
Frequently Asked Questions
Does GramFile test every app before listing it?
Yes. Every new listing and every version update goes through the same process: official source, VirusTotal scan, a hands-on install (on a clean Windows 11 machine for Windows apps), hands-on use, and an original write-up. Big-name apps get no exceptions.
Are macOS and Android apps reviewed the same way?
Yes. The five steps apply to every platform. Windows, macOS, Android, and OS ISO listings all start from the official source, are scanned before they are opened, and are reviewed by a person before they go live. The platform table above shows what we watch most closely on each.
Who reviews the software on GramFile?
The editorial team, led by founder Dr. Mohamed Zaki, who has the final say on what gets published. Each reviewer covers one area, such as productivity, security, media, or games.
How does GramFile scan downloads for malware?
We scan each installer with VirusTotal before opening it. VirusTotal checks the file against more than 70 antivirus and threat-detection engines, and we cross-check ambiguous results with other scanners.
What happens if one antivirus engine flags a file?
We hold the listing and investigate. We look at what triggered the detection, whether it matches a known false-positive pattern for that vendor, and whether high-confidence engines agree. If the doubt doesn't resolve cleanly, we don't publish.
Can developers pay to be listed or get a top-pick badge?
No. A developer can't pay to get listed, to get a "top pick" badge, or to have a negative note removed. Our editorial policy covers the separation between advertising and editorial decisions.
Why do some listings show an older version?
We only publish versions we have tested. When a new version adds something we can't accept, such as bundleware, the listing stays on the previous version with a note explaining why.
How do I report a problem with a download?
Use the Report a Problem page. It goes directly to the editorial team, not a general inbox.