PDF & Document
Redaction for Privacy Requests

Find and permanently remove sensitive information from PDFs, scanned documents and images - all processed on your device.

Start Redacting Free

Fully featured Pro trial on your first document. Packs from $25.

Verifiable exports - no account needed Cyber Essentials certified Public-sector procurement ready

Data subject requests · Public records · Litigation discovery · HR investigations · Medical records · Court filings

John Smith 012 3456 7890 GB82 WEST 1234 5678 Verified
See for yourself

Not every black box is a redaction

Many PDF tools draw a shape over the text. The words are still in the file. Try it yourself - select both bars below with your cursor.

A typical overlay "redaction"

Payment to IBAN: GB82 WEST 1234 5678

Select the black bar above. The text is still there - anyone who receives the file can copy it straight out.

A RedactProof redaction

Payment to IBAN:

Now select this one. Nothing. The content is destroyed at the pixel level - it no longer exists in the file.

Have a document you're not sure about? Run it through Inspect →

A quick self-check

How many of these sound familiar?

Tick any that apply - each one gets an answer. Most redaction failures come from process, not carelessness, and one exposed line is enough to make a disclosure reportable.

How RedactProof handles thisThat is overlay redaction failing - the demo above is exactly this. Pixel-burn destroys the content in the file; there is nothing underneath to copy.
How RedactProof handles thisYou review a listed set of findings before export, not 214 pages by eye. Teams can make the double-check someone else's job entirely - an approval workflow routes finished work to a second person who reviews and exports it. And the export is tamper-evident - if anything changes afterwards, verification fails.
How RedactProof handles thisDetection sweeps every page for 60+ categories of personal data, and repeat occurrences are flagged together - the count stops being a guess.
How RedactProof handles thisText recognition runs on your device, so scanned pages become searchable - then pattern matching does the deciding: the string either fits a phone number, an IBAN, a reference format, or it doesn't. Your eyes stop being the validator.
How RedactProof handles thisDetection turns 200 pages into a reviewed list of findings. You rule on each one and the bundle goes out tonight - not tomorrow.
How RedactProof handles thisVerification tells you what each file actually is - which export, from when, and unchanged since. The filename stops mattering; the certificate is the identity.
How RedactProof handles thisBy default, everything stays on your device: the file, its text layer, its contents. Nothing is uploaded, so there is nothing for cloud-processing or data residency rules to attach to. The one exception is opt-in and clearly labelled - and admins can disable it at policy level.
How RedactProof handles thisOn the Pro plan, evidence is the default output: every export carries a tamper-evident certificate and a redaction log with exemption codes, backed by the account's audit history - all ready to hand over without preparing anything. The free trial runs at Pro level, so you can see it on your own document today.

Try it on one document - free

Marketing, translated

Four promises you’ll meet when comparing tools

Seen in the wild:
The claim's gap

The same encryption as any website

“Military-grade” is AES-256 - the same encryption as every login page. The claim quietly tells you your document travels: encrypted to their servers, decrypted on arrival - and now it's a data residency issue.

Where we stand

Nothing to encrypt in transit

By default your document never travels, so transit encryption has nothing to protect. What matters is the redaction itself: pixel-burn destroys the content in the file, and the certificate makes any later change detectable.

Encryption protects data on the move and at rest. Read the claim again: if your document needs encrypting in transit, it's because it travels.

The claim's gap

Is the extracted text uploaded?

The file itself stays put - but the text layer, the sensitive part, goes to a third-party server for processing. Personal data has travelled, and data residency obligations follow it, whether or not a "file" was uploaded.

Where we stand

On-device, text layer included

Your file, its text layer, the detection and the export: all of it stays on your device. This is the default architecture on every plan. Precision Engine is the opt-in exception on Pro plans, and admins can disable it at policy level.

Check what actually travels. "No file uploads" can be true while the extracted text - every name, number and address in the document - is sent to the cloud for detection.

The claim's gap

So who caught the misses?

Detection is good at finding candidates. But every detector has false positives and misses, and no accuracy figure changes that. It also can't decide what must be withheld - that's judgement, not pattern-matching. "Fully automated" means nobody caught the misses. If accuracy matters, a person belongs in the loop.

Where we stand

You decide - and it's on the record

A person approves every redaction before export; exemption codes capture the why, and the redaction log keeps the record. Teams can add an approval workflow: a second person reviews the work and exports under their own name. That chain - decision, reason, record - is what stands up to a regulator or court.

Automatic detection is genuinely good - but it isn't judgement. A reliable redaction process pairs the two, and can prove who decided what.

The claim's gap

99% of what, measured where?

That number came from a benchmark the vendor chose - not from your scans, your formats, your edge cases. Quoted without a corpus, a document type or a recall figure, it can't be checked.

Where we stand

Layered detection, human-checked

Layered detection - patterns for structured data, AI and manual tools for the rest, recursive checks at export. Our aim is different from a benchmark: give you the tools to take each document to 100%, signed off at your discretion.

Accuracy numbers without a corpus, a document type, and a recall figure are marketing. And even at face value: 99% across a 10,000-item disclosure is a hundred leaks.

What you get

Built for Compliance

You make every call. Everything you need for secure, verifiable document redaction.

Privacy by Default

Files open in the editor and stay on your device - no cloud processing, no data residency concerns. It works like a desktop app, no install needed.

Only content-free metadata reaches our servers - cryptographic fingerprints to verify redactions, plus redaction coordinates for optional team workflows. The files themselves - contents, text, filename, everything - stay on your device.

Stay in Control

AI never redacts on its own. Every suggestion is yours to accept, refine, or reject - per word, line, or region. Manual tools are available on every plan.

Reveal mode flips the workflow: everything starts redacted, and you reveal only what's safe to share. The control is yours, either direction.

Ready for Disclosure

Helps you meet your compliance obligations - clinical disclosures, FOI/SAR responses, insurance submissions, and more.

On Pro, every disclosure is inspectable end-to-end: Bates numbering, exemption codes, tamper-evident certificates, and CSV redaction logs.

And every disclosure leaves with its paperwork

Three files with every Pro export (the free trial runs at Pro level), a report at the recipient's end, and the account history behind them all. Depending on your business needs, you can switch any of these off - or change how they're packaged and downloaded to fit your systems.

Start to finish

How It Works

Explore each step

Start to finish
1
🔍
PII Detection
Names, phones, IBANs
2
◼◼◼
Redaction
Permanent removal
3
🔒
Proof
Tamper evidence
Five tools for finding personal data in documentsFive tools for finding personal data
Automatic and manual, all on your device - and every result waits for human review.
I can confirm that John Smith attended on March 14. Contact (555) 123-4567 regarding case 2024/0871; a copy is held by Smith & Partners LLP. Signed, J. Carter.
1Pattern matching60+ structured types
(555) 123-4567
2On-device AIevery suggestion reviewed
John Smith
3Search & propagaterepeats queued for you
case 2024/0871 ×14
4Exclusion listcleared once, left alone
Smith & Partners LLP
5Manual selectionbox, word and line tools for anything detection cannot judge
6Human reviewnothing redacted without approval - grouping speeds the workflow
✓ Approve ×14✗ Reject
Automatic detection accelerates the work; it does not replace judgement. Misses and false positives are inherent to any detector - which is why the layers end with you.
Permanent Redaction
Drag to compare before and after
✓ Protected
I can confirm that the applicant,John Smith, attended the
meeting on March 14. Contact:(555) 123-4567
regardingcase 2024/0871. The SSN
078-05-1120was verified against records
Payment went to:a checking account
⚠ Exposed
I can confirm that the applicant,John Smith, attended the
meeting on March 14. Contact:(555) 123-4567
regardingcase 2024/0871. The SSN
078-05-1120was verified against records
Payment went to:a checking account
Covering text with a black box is not redaction: many tools leave the words underneath. RedactProof re-renders the page so the content under the bars is removed from the file, not hidden - which is what the certificate then evidences.
Evidence that survives the follow-up
No tool can prove your redaction decisions were right. What the certificate settles is everything else.
Eighteen months later

"Can you confirm this is the document you released, and that it hasn't been changed since?"

Any party - you, the recipient, an auditor - can verify it in a browser, no account, no involvement from us. The audit trail of who approved what stands ready alongside it.
Verified verify.json
  • The exact file you exported, unaltered since
  • Produced from your original, never shared
  • What was withheld, by category, never the values
SHA-256  1e21cfe7…f0b3b9e  ·  signature valid
The certificate travels with its paperwork: an optional per-reference redaction schedule in the document itself, the CSV log and audit trail of who approved what in your export bundle, and a copy in Certificate History you can re-download any time.
The certificate cannot prove you redacted the right things - that judgement was yours, and the audit trail records who made it. What it gives you is tamper evidence for everything after export.

Put your next bundle through it →

Verify us

Don't take our word for it

Every claim on this page is checkable. That is the point of the product.

Watch the network while you work

Open your browser's developer tools, work through a document, and filter the Network tab by your filename - or any phrase from your document. You get nothing: the document is never in any request. What does leave your device: anonymous usage events, and on export a cryptographic fingerprint (a SHA-256 hash) of the file. The one large transfer you will see is a download - the detection model arriving so the scan can run locally. The only exception is the optional Precision Engine - strictly double opt-in via settings - which sends extracted text for server-side enhanced detection once a Pro user has selected and consented to it.

Cyber Essentials

Certified. Independently verifiable in the registry.

View certificate →

ICO registered

UK data protection register, Popsall Ltd.

Check the register →

CDP registered

Registered supplier for public-sector procurement.

Details →

Verify it yourself

Check any export against its certificate, on-device.

Open the verifier →

Pricing that scales with you

From a one-off pack to organisation-wide - pay for how you actually work

Free trial · one document, full Pro features, no card
Flex Pack · best for occasional, one-off jobs
Core · best for individual professionals
Pro · best for regulated and audited work
Public Sector · best for procurement-led buyers
Fully featured Pro trial on your first document

Start redacting before you even have an account. One source document with Pro-level features, unlimited edits and re-exports, no card required. You'll only be asked for an email address when you want to download your redacted file.

Start with your document

Flex Pack

For occasional redaction work

$25 one-off5 documents · $5.00 each

Includes:

  • Core processing features per document
  • Valid 13 months from purchase
  • Top up any time
  • No verification certificates or audit trail
Buy 5-document pack

One-off payment · no renewal

Core

For individual professionals

$249/year per user$20.75/month equivalent

Includes:

  • On-device AI detection, 60+ PII types - up to 10x faster with the optional Accelerator
  • Documents never leave your device
  • PDF & image redaction, with OCR restoration
  • Unlimited documents, fair use
Get your licence

Single user · 14-day money-back guarantee.

Public Sector & Contract

For procurement-led buyers

Invoice or POAnnual agreement, priced per seat

Everything in Pro, plus:

  • Invoice / PO billing with payment terms
  • Signed DPA, attestation pack & subprocessor list
  • On-device processing, enforceable organisation-wide
  • Named contact, priority phone support & onboarding options
Published pricing →

Resellers and distributors: quote by email.

14-day money-back guarantee on Core and Pro · Cyber Essentials certified · Compare all features
2026 guide Still weighing your options? We compared 18 redaction tools, including the jobs where another tool is the better pick. Read the guide →
Redaction for lawyers Buyer's guide Bulk redaction Security All resources

Common questions

Do my documents get uploaded anywhere?

No. The document opens and is processed in your browser. What reaches our servers is content-free: a cryptographic fingerprint to issue the verification certificate, plus redaction coordinates if you use saved sessions or team approvals - never the file, its text, or its name. (The optional Precision Engine, clearly labelled and off by default, sends extracted text for deeper analysis - never the document.)

Is the redaction permanent?

Yes. Pixel-burn destroys the content at the image level - no hidden layers, no overlay to peel back, nothing to recover. The certificate then makes any later change to the file detectable.

Is the free trial actually free?

Yes. One source document with full Pro-level features, unlimited re-exports of that document, no card. If it doesn't earn an upgrade, you've lost nothing.

I only redact occasionally - do I need a subscription?

No. Flex Packs cover 5 documents (£19) or 25 documents (£59), valid for 13 months, no subscription.

Can recipients verify a document without an account?

Yes. They scan the QR on the certificate or open the verify link - no account, no contact with you or with us. Verification also works fully offline from the export's verify.json file.

Can a second person review redactions before they're released?

Yes. On team accounts, members can be set to “approval required”: they prepare and submit redaction work, and an approver reviews the same work on their own copy of the document and exports it under their own name - the separation-of-duties control auditors call maker-checker. Every step is audit-logged.

Does it work on scans and photos?

Yes. Text recognition runs on your device, so scanned pages and images can be searched and redacted like any other page.

Do I need IT approval or an install?

It runs in a modern browser - nothing installs. (An optional desktop accelerator exists for heavy workloads, but nothing requires it.)

Redact with Confidence

Documents stay on your device. Just your email to begin.

Start Redacting

Not ready to pick a plan? Start with the free document - upgrade only if it earns it.

RedactProof

Get in touch

By submitting, you agree to our privacy policy. We store your email and message to respond to your enquiry.

or email us directly
hello@redactproof.com