Redact sensitive data

Why this works

True redaction removes the underlying text and image data, replacing it with a black bar. Even if a recipient extracts the PDF source, the redacted content is gone for good.

Redaction is one of the most-misunderstood operations in document workflows. Most people who try to redact a PDF do so by drawing a black rectangle on top of the text — in Adobe Reader\'s commenting tools, in Preview, in Word after exporting to PDF. The result looks redacted: the sensitive text is visually covered. But the original text is still in the file\'s underlying data layer. Anyone who copies and pastes from the PDF, runs it through a text-extraction tool, or opens it in Adobe Acrobat\'s editor sees the original text. This has caused real-world data breaches — famously, courts and government agencies have published “redacted” documents where reporters extracted the underlying text with simple copy-paste and published the originally-confidential content.

True redaction is destructive. The text and image data is removed from the file, not covered. A black bar appears where the content was, but the content itself — the bytes representing the redacted words or images — is gone. Copy-paste, text extraction, forensic PDF tools, even attempting to OCR the page: all return only the redaction bar, not the underlying text. This is the only redaction that withstands a determined recipient.

What true redaction looks like step by step. Identify the content to remove: either manually (draw rectangles over sensitive regions) or via pattern detection (auto-find SSNs, credit card numbers, email addresses, phone numbers using regex matching). Apply destructive removal: the text fragments inside the marked rectangles are stripped from the page content stream, embedded image data inside the rectangles is replaced with solid colour, and any associated form fields or annotations covering that area are removed. Verify the result: re-parse the output PDF and confirm no readable text remains in the redacted regions — our tool does this automatically before delivering the file. Strip metadata: the PDF\'s author tag, revision history, comments, and edit timestamps are cleared as a side-effect, since these often contain context that could re-identify what was redacted.

What to redact, by category. Personal identifiers: full names of individuals, dates of birth, social security numbers, national insurance numbers, passport numbers, driver\'s licence numbers. Financial details: bank account numbers, credit card numbers, routing numbers, salary figures, individual transaction amounts when context could re-identify them. Health information: patient names, diagnoses, treatment dates, prescriber names, insurance ID numbers — HIPAA and similar regulations specify exactly what constitutes PHI. Contact information: home addresses, personal phone numbers, personal email addresses, when these aren\'t necessary for the document\'s purpose. Privileged content: attorney-client communications, work product, internal deliberations not meant for the other side in litigation.

Where redaction interacts with other workflows. Before sharing: always redact before adding watermarks (watermarks composite onto the page after redaction is applied, so they can\'t leak underlying content). Before signing: redact first, then sign — a signed PDF can technically be edited (with the signature invalidating) but signed-then-redacted creates audit complications. Before flattening: redact, then flatten — flattening locks the redaction permanently into page content and clears any remaining annotation-layer artefacts. Before compression: redaction\'s effectiveness doesn\'t change with subsequent compression, but compression after redaction is fine and often desirable for file-size compliance.

Legal and compliance considerations. For GDPR-sensitive redactions (right to erasure, data minimisation), true redaction satisfies the technical requirement to remove personal data, but you should also document the redaction in your processing records. For HIPAA de-identification, redaction is one of the 18 categories of PHI handling — but full HIPAA de-identification typically requires removing 18 specific identifiers and a statistical disclosure review; redaction alone is necessary but not sufficient for that standard. For attorney-client privilege redaction in discovery, court rules may specify exactly what categories must be redacted and how the redaction must be documented (privilege log entries); the technical redaction is one part of the broader compliance workflow.

A workflow tip for repeat patterns. If you regularly redact the same kinds of content (e.g. monthly account-number redaction on bank statements before sending to a third party), use the auto-detect patterns option — SSNs, credit card numbers, email addresses, and phone numbers can be detected by regex and redacted in one click across the entire document. Saves manual rectangle-drawing on every page.

How it works