Redaction Audit Trail Software: What It Records

What a Redaction Audit Trail Must Show

A redaction audit trail is the set of records that lets someone else reconstruct a redaction decision after the fact - typically months later, often someone who was not involved and is not inclined to take your word for it. In practice that means answering six questions.

Question	What answers it	Where it lives
What kind of data was removed?	One row per redaction, describing the category withheld - never the value	Redaction log
Where was it?	Reference ID and page number for each redaction	Redaction log
Why was it withheld?	Exemption code and its official description	Redaction log
Who produced it, and when?	Certificate attribution and ISO 8601 timestamp	Export record
Has it been altered since?	SHA-256 hashes under an Ed25519 signature	Export record
Did anyone change the rules?	Every configuration and team policy change	Settings history

The distinction that matters most is between records that travel with the document and records that stay in your account. A recipient can only check what you sent them; a regulator or opposing party may later ask for what you kept. RedactProof produces both, and neither requires the original document to be stored anywhere.

The Three Records

Every export on Pro, and on the one-document trial, produces all three:

Loading diagram...

1. The Redaction Log

One row per redaction applied, in reading order. It exists in two forms, both generated in your browser during export:

A table printed into the PDF, alongside the certificate page, so the log cannot be separated from the document it describes.
A machine-readable CSV named {document}_redaction_log.csv, for ingestion into compliance and eDiscovery tooling.

The log never contains the redacted values

Each row describes the category of information withheld - "Redacted email address", or the official wording of the exemption code you applied - and where on the page it appeared. The text itself is destroyed during export and never written to the log. A redaction log that quoted what it redacted would simply be a second copy of the problem, distributed alongside the first.

CSV columns

Column	Contains
Document	Source filename, or the Bates range when Bates numbering is enabled
Date	Timestamp of the export
Ref	Reference ID for the redaction, matching the marker printed on the page
Page	Page number the redaction appears on
Code	Exemption code(s) applied. Empty when no code is assigned
Description	The code's official description, or a type label such as "Redacted email address" where no code is used
Source	`Auto` for a detection you approved, `Manual` for one you drew yourself
Confidence	Detection confidence as a percentage. Empty for manual redactions, which have no score
Engine	Which detection route produced the match - `regex`, `standard` or `precision`

The file follows RFC 4180 with CRLF line endings, a header row, and quoting for any field containing a comma, quote or newline. Excel and the major eDiscovery platforms ingest it without conversion.

Why every row repeats the document name and date

It looks redundant in a single file, and it is - until you have forty of them. Because provenance is carried on the row rather than in the filename, logs from separate exports can be concatenated into one master sheet and still sort, filter and pivot correctly.

Interactions worth knowing

Bates numbering forces the log on. A Bates-stamped bundle without a per-redaction log is not much use, so enabling Bates makes the CSV mandatory and the toggle read-only. The Document column then carries the Bates range - for example RP000001-RP000042 - rather than the filename.
The Code column is only populated if you use exemption codes, which are a Pro feature. Without them the log still answers what and where, but not why. See exemption codes.
Manual redactions are logged identically to automatic ones, marked Manual with no confidence score. Nothing you draw by hand is left out of the record.

2. The Export Record

Each export registers a certificate against your account. This is the record that lets a recipient confirm, independently, that the file they hold is the file you produced. It is listed under Certificate History in your dashboard.

Field	Contains
cert_id	Unique certificate identifier, printed on the certificate page and encoded in its QR code
timestamp	ISO 8601 time of export
original_hash	SHA-256 of the source document
redacted_hash	SHA-256 of the exported document
entity_counts	Number of redactions by category
page_count	Pages in the exported document, excluding the certificate page
certified_by	Your email address, an account reference ID, or hidden - whichever attribution mode is set
signature	Ed25519 signature covering every field above

The document itself is never stored - only these fields. Hashes are one-way, so nothing about the content can be recovered from them. How the signature is checked is covered in verification.

Tracking re-exports of the same document

Certificate History can be viewed two ways. By Certificate is a flat list, newest first. By Document groups certificates by the hash of the original file, so every export derived from the same source appears in one chain with the most recent marked as latest.

That grouping is what answers the awkward version question - "you disclosed this in March and again in June, what changed?" - without you having to keep a spreadsheet. Each entry links to its verification page, and the signed verify.json can be downloaded again at any time if a recipient loses theirs.

Turning it off

The server-side record is optional. Under Settings then Privacy & Data, "Server-side audit trail" can be switched off, unless a team administrator has locked it on. With it off:

Exports still include a signed verify.json, and recipients can still verify offline by supplying that file
Certificate History is empty - there is nothing to list
QR code lookups return "not found", because there is no server record behind the certificate ID
Recipients cannot verify by supplying the PDF alone

It is a genuine trade-off between minimising what we hold and keeping a usable trail, and it is yours to make.

3. Settings and Policy History

The first two records describe documents. This one describes the configuration that produced them - and it is the record that gets asked for when someone suspects the process, not the output.

Every change to redaction behaviour is logged with what changed and when, across five categories:

Category	Examples of tracked changes
Detection	Detection threshold changed
Certificate	Attribution changed, certificate position changed
Exemption	Default jurisdiction changed, default document mode changed, behaviour for unattributed redactions changed
Account	Marketing preference changed
Team	Member role changed, attribution lock changed, mandatory certificates changed, mandatory logging changed, log visibility changed

The whole history exports to CSV from the dashboard. The single most useful thing it demonstrates is a negative: that detection sensitivity was not quietly lowered in the run-up to a disclosure.

Team controls

On Pro, from two seats, administrators can additionally:

Require export records, so members cannot disable the server-side trail
Require verification certificates on every export
Require an exemption code on every redaction
Lock attribution to email, account reference, or hidden
Control history visibility - team-wide certificate history for all members, or administrators only

Each of those policy changes is itself logged.

What's Available on Each Plan

Capability	Trial	Core	Pro
Redaction log (in-PDF table and CSV)	Yes	-	Yes
Export records and Certificate History	Yes	-	Yes
Settings history and CSV export	Yes	-	Yes
Exemption codes in the `Code` column	Yes	-	Yes
Bates numbering	Yes	-	Yes
Team-wide history and policy locks	-	-	Yes(2+ seats)

Core exports do not include certificates or an audit trail - the redaction log, export records and settings history are all Pro features. The one-document trial includes the full audit trail so you can see exactly what a Pro export produces. Full detail on compare plans.

What We Store, and For How Long

Record	Where it is held	Retention
Your document and its text	Your device only - never transmitted	Never held by us
Redaction log CSV	Generated in your browser, written into your export	Never held by us
Export records (hashes, counts, signature, timestamps)	Our database	Life of the account
Settings and policy history	Our database	Life of the account

Deleting your account cascade-deletes every export record and history entry attached to it. There is no separate retention clock and no archival copy. If you need records to outlive the account, export the settings history to CSV and keep the verify.json files from your exports - those verify offline, indefinitely, with no dependency on us.

What the Audit Trail Does Not Prove

Not that the redactions were correct. The log records what kind of data you removed, not whether you were right to remove it - or right to leave something in.
Not what you chose not to redact. Text you never flagged leaves no trace in the log, by definition. The trail is evidence of process, not of completeness.
Not verified identity. Attribution names the account that produced the export. It is not a checked identity claim about the person at the keyboard.
Not a case management system. It records what RedactProof did. Your reasoning, approvals and correspondence belong in your own disclosure log.

Verification certificates and audit records provide evidence of document handling. They do not replace professional judgement, and they are not in themselves a finding of regulatory compliance. Consult your legal or data protection team on what your specific disclosure requires.

Frequently Asked Questions

Does RedactProof produce an audit trail for PDF redaction?

Yes, on Pro and on the one-document trial. Every export produces three separate records: a per-redaction log listing the category of each item withheld with its page, reason code and detection source; an export record holding SHA-256 hashes of the original and redacted files with an Ed25519 signature; and a settings history recording every change to your redaction configuration. The first travels with the document, the other two stay in your account. Core does not include the audit trail - see Plan Availability below.

Can I export the redaction log into Excel or an eDiscovery platform?

Yes. The redaction log is written as an RFC 4180 CSV with CRLF line endings and a header row, which Excel, Relativity and most eDiscovery tools ingest without conversion. Every row carries a Document and Date column so logs from multiple exports can be concatenated into one master sheet without losing provenance.

Does the audit trail record the contents of my document, or the text that was redacted?

Neither. The redaction log records the category of each item withheld - for example "Redacted email address" - along with its page and reference number, never the value itself. The server-side record holds SHA-256 hashes of the original and redacted files, a count of redactions by category, the page count and a timestamp. Hashes are one-way fingerprints, so nothing can be reconstructed from them, and the document is never uploaded in the first place.

Can I turn the server-side audit record off?

Yes, under Settings then Privacy and Data, unless a team administrator has locked it on. With it off, exports still include a signed verify.json file that recipients can verify offline, but Certificate History stays empty, QR code lookups return not found, and recipients cannot verify by supplying the PDF alone.

How long are export records kept?

For the life of the account. Deleting your account cascade-deletes every certificate record, settings history entry and terms acceptance associated with it. There is no separate retention clock and no archival copy.

Can a team administrator see everyone’s redaction history?

On Pro, from two seats, administrators see a team-wide certificate history. A policy setting controls whether that history is visible to all members or to administrators only. Administrators can also require export records so members cannot disable them.

Audit Trail for PDF Redaction