Redact disclosure and court bundles without uploading a single file

A black box is not a redaction

The most common redaction mistake is also the most dangerous: drawing a black rectangle over text instead of removing it. The text underneath survives, and anyone can recover it by copying and pasting, or by stripping the overlay. Guidance from the US National Security Agency puts it plainly: information that is merely hidden or covered in a document can almost always be recovered, so it has to be removed, not just concealed.

A 2022 study, Story Beyond the Eye: Glyph Positions Break PDF Text Redaction, went further. The researchers tested 11 popular redaction tools, including Adobe Acrobat, and showed that even tools that delete the text often leak the position of every character, enough to reconstruct redacted names. They de-redacted hundreds of real-world redactions in published investigation reports and freedom-of-information responses. In disclosure, that is the difference between a compliant production and a data breach sitting inside the bundle.

What pixel-burn does differently

RedactProof does not draw over the text. It rasterises the affected region and burns the redaction into the page, destroying the underlying characters and the spacing between them. The redacted content cannot be copied, searched, or reconstructed from glyph positions. What you redact is gone, not hidden.

Scoping a disclosure bundle

Before anything leaves the firm, every responsive document has to be reviewed for what must come out. The National Archives Redaction Toolkit, written for freedom-of-information and data-protection work, sets a basic rule worth borrowing for litigation: always redact a copy and leave the original intact, so you can justify each decision later.

Third-party personal data. Names, addresses and identifiers of anyone who is not your client, including witnesses, opposing parties and people mentioned in passing.

Privileged material. Legal advice and litigation-privileged communications that have crept into otherwise disclosable documents.

Irrelevant sensitive content. Medical, financial or special-category data that is not relevant to the issues and should not be in the bundle at all.

Bates numbering, logs and proof of integrity

For a court-ready production, RedactProof adds Bates numbering and a CSV log of every redaction, and can attach a tamper-evident, Ed25519-signed certificate. The receiving side scans a QR code to confirm the file has not been altered since you exported it, without needing an account or the original tool.

Subject access requests raise the same redaction problem on a tighter clock. If your team also handles those, see our redaction page for compliance teams.