Just a warning: by default it doesn't protect your documents from reading. It isolates the process, all writes (filesystem, registry) go to the sandbox instead

Just a warning: by default it doesn't protect your documents from reading. It isolates the process, all writes (filesystem, registry) go to the sandbox instead of the host filesystem, so a malicious software can't easily install itself. But reading data is mostly unprotected by default, so a malware ran in a sandbox may steal some sensitive data. To protect such data you have to pre-configure sandbox manually.