Understanding Your Redacted PDF Export Bundle

ZIP Bundle Contents

Pro exports, and exports from the one-document trial, contain two files in a ZIP archive. Core and Flex Pack exports are a single redacted PDF without the verification certificate - see Compare Plans for what each tier includes.

Loading diagram...

The Redacted PDF

Your document with approved redactions applied
Includes a certificate page (first or last, per your settings) with QR code
Redactions are permanent - underlying text is destroyed, not hidden
Text layer restored via OCR for accessibility (included on every current plan)
No source metadata survives - the file is rebuilt from page images (see detection coverage & limitations)

The Verification Certificate (verify.json)

A machine-readable file containing the cryptographic evidence a recipient uses to confirm your document is exactly what was exported:

Field	Description
cert_id	Unique identifier for this certificate (e.g., "rp_abc123xyz")
timestamp	ISO 8601 timestamp when the document was redacted
original_hash	SHA-256 hash of the original document before redaction
redacted_hash	SHA-256 hash of the redacted document
entity_counts	Count of redactions by category (e.g., { names: 5, addresses: 2 })
signature	Ed25519 digital signature covering all certificate fields

Why Two Files?

The verify.json file enables independent verification without requiring the recipient to trust the PDF itself. They can verify the Ed25519 signature to confirm the certificate is genuine, then calculate the PDF's hash to confirm it hasn't been modified.

Certificate Page in the PDF

The certificate page embedded in your PDF includes:

QR Code: Scannable link to the verification page
Certificate ID: Unique identifier for lookup
Timestamp: When the document was redacted
Redaction Summary: Count of items redacted by category
Verification URL: Where recipients can verify the document

Who Sees What: the Export Decision Tree

An export produces two kinds of artefact with two different audiences. Everything inside the PDF travels with the document to whoever you send it to; everything inside the audit ZIP stays with you as your own record. Nothing in the ZIP is needed for a recipient to verify the document.

Artefact	Where it lives	Audience	What it says
Certificate page	Appended to the PDF	The recipient	This document is sealed - scan the QR or visit the verifier to confirm it is unaltered
Redaction schedule	Appended to the PDF if your summary format includes it	The recipient	What each reference (R01, R02...) withheld, by category and exemption code - never the values
verify.json	Audit ZIP	You (and anyone you choose to give it to)	The signed cryptographic certificate - enables a fully offline verification
redaction-log CSV	Audit ZIP	You - internal record, spreadsheets, case systems	The same schedule as machine-readable rows

Choosing a summary format

Settings → Certificates & Exports → summary format controls how much the certificate discloses to the recipient:

Page aggregate - totals only ("7 redactions across 1 page"). Choose this when you do not want to disclose the structure of what was withheld - common in litigation, where the redaction log is your record and is produced on request rather than volunteered.
Per-redaction - a reference table, one row per redaction with its category and any exemption code. Choose this when the recipient is entitled to the schedule - FOI and EIR responses, subject access requests, and publication schemes expect it.
Both - totals on the certificate page plus the full table.

Whichever you choose for the PDF, your own audit ZIP always carries the complete per-redaction record. The setting only changes what travels.

Automatic vs manual, on the certificate

The certificate counts how redactions came to be: automatic means proposed by detection (pattern matching or on-device AI) and approved by you; manual means you created it yourself - a drawn box, a word selection, or a redact-list term. Items you add through the redact list keep their manual provenance even though they pass through the same review-and-approve step as detected items. Either way, the certificate's core statement holds: every redaction was reviewed and approved by a person. The automatic/manual split is diagnostic detail; the review guarantee is the part that carries weight.

For legal and FOI work, the exemption code on each redaction is the field that does the justifying - it records the ground (privilege, third-party data, a statutory exemption) the way a disclosure schedule expects. Categories say what kind of thing was withheld; codes say why.

Legal Discovery Export (Pro)

Pro subscribers, and the one-document trial, can export a legal discovery bundle alongside the standard ZIP. This is designed for litigation disclosure, regulatory responses, and FOI/SAR workflows.

The legal discovery bundle adds two additional files:

Bates-numbered PDF: Each page stamped with a sequential Bates number (e.g. RP000001) for unambiguous document reference in correspondence and court filings.
Redaction log (CSV): Machine-readable log of every redaction applied - entity type, page number, confidence score, and exemption code if assigned.

Bates numbering and the CSV log together make every disclosure traceable end-to-end. Recipients can cross-reference the log against the redacted PDF without needing to re-open the original.