Redaction Audit Trail Software: FOIA & Discovery

What a Redaction Audit Trail Must Show

A redaction audit trail is the set of records that lets someone else reconstruct a redaction decision after the fact - typically months later, often someone who was not involved and is not inclined to take your word for it. Whether that is a requester challenging a FOIA withholding, opposing counsel reviewing a production, or an auditor sampling your process, it comes down to six questions.

Question	What answers it	Where it lives
What kind of data was removed?	One row per redaction, describing the category withheld - never the value	Redaction log
Where was it?	Reference ID and page number for each redaction	Redaction log
Under what exemption?	Exemption code and its official description	Redaction log
Who produced it, and when?	Certificate attribution and ISO 8601 timestamp	Export record
Has it been altered since?	SHA-256 hashes under an Ed25519 signature	Export record
Did anyone change the rules?	Every configuration and team policy change	Settings history

The distinction that matters most is between records that travel with the document and records that stay in your account. A requester can only check what you produced; a court or an oversight body may later ask for what you kept. RedactProof produces both, and neither requires the original document to be stored anywhere.

The Three Records

Every export on Pro, and on the one-document trial, produces all three:

Loading diagram...

1. The Redaction Log

One row per redaction applied, in reading order. It exists in two forms, both generated in your browser during export:

A table printed into the PDF, alongside the certificate page, so the log cannot be separated from the document it describes.
A machine-readable CSV named {document}_redaction_log.csv, for ingestion into compliance and eDiscovery tooling.

The log never contains the redacted values

Each row describes the category of information withheld - "Redacted email address", or the official wording of the exemption you claimed - and where on the page it appeared. The text itself is destroyed during export and never written to the log. A withholding log that quoted what it withheld would simply be a second copy of the problem, produced alongside the first.

CSV columns

Column	Contains
Document	Source filename, or the Bates range when Bates numbering is enabled
Date	Timestamp of the export
Ref	Reference ID for the redaction, matching the marker printed on the page
Page	Page number the redaction appears on
Code	Exemption code(s) applied, such as a FOIA (b)(6) withholding. Empty when no code is assigned
Description	The code's official description, or a type label such as "Redacted email address" where no code is used
Source	`Auto` for a detection you approved, `Manual` for one you drew yourself
Confidence	Detection confidence as a percentage. Empty for manual redactions, which have no score
Engine	Which detection route produced the match - `regex`, `standard` or `precision`

The file follows RFC 4180 with CRLF line endings, a header row, and quoting for any field containing a comma, quote or newline. Excel and the major eDiscovery platforms ingest it without conversion.

Why every row repeats the document name and date

It looks redundant in a single file, and it is - until you have forty of them. Because provenance is carried on the row rather than in the filename, logs from separate exports can be concatenated into one production-wide sheet and still sort, filter and pivot correctly.

Interactions worth knowing

Bates numbering forces the log on. A Bates-stamped production without a per-redaction log is not much use, so enabling Bates makes the CSV mandatory and the toggle read-only. The Document column then carries the Bates range - for example RP000001-RP000042 - rather than the filename, so every withholding ties back to a specific stamped page.
The Code column is only populated if you use exemption codes, which are a Pro feature. Without them the log still answers what and where, but not under which exemption. See exemption codes.
Manual redactions are logged identically to automatic ones, marked Manual with no confidence score. Nothing you draw by hand is left out of the record.

2. The Export Record

Each export registers a certificate against your account. This is the record that lets a recipient confirm, independently, that the file they hold is the file you produced. It is listed under Certificate History in your dashboard.

Field	Contains
cert_id	Unique certificate identifier, printed on the certificate page and encoded in its QR code
timestamp	ISO 8601 time of export
original_hash	SHA-256 of the source document
redacted_hash	SHA-256 of the exported document
entity_counts	Number of redactions by category
page_count	Pages in the exported document, excluding the certificate page
certified_by	Your email address, an account reference ID, or hidden - whichever attribution mode is set
signature	Ed25519 signature covering every field above

The document itself is never stored - only these fields. Hashes are one-way, so nothing about the content can be recovered from them. How the signature is checked is covered in verification.

Tracking re-productions of the same document

Certificate History can be viewed two ways. By Certificate is a flat list, newest first. By Document groups certificates by the hash of the original file, so every export derived from the same source appears in one chain with the most recent marked as latest.

That grouping is what answers the awkward version question - "you produced this in March and again in June, what changed?" - without you having to keep a spreadsheet. Each entry links to its verification page, and the signed verify.json can be downloaded again at any time if a recipient loses theirs.

Turning it off

The server-side record is optional. Under Settings then Privacy & Data, "Server-side audit trail" can be switched off, unless a team administrator has locked it on. With it off:

Exports still include a signed verify.json, and recipients can still verify offline by supplying that file
Certificate History is empty - there is nothing to list
QR code lookups return "not found", because there is no server record behind the certificate ID
Recipients cannot verify by supplying the PDF alone

It is a genuine trade-off between minimizing what we hold and keeping a usable trail, and it is yours to make.

3. Settings and Policy History

The first two records describe documents. This one describes the configuration that produced them - and it is the record that gets asked for when someone challenges the process, not the output.

Every change to redaction behavior is logged with what changed and when, across five categories:

Category	Examples of tracked changes
Detection	Detection threshold changed
Certificate	Attribution changed, certificate position changed
Exemption	Default jurisdiction changed, default document mode changed, behavior for unattributed redactions changed
Account	Marketing preference changed
Team	Member role changed, attribution lock changed, mandatory certificates changed, mandatory logging changed, log visibility changed

The whole history exports to CSV from the dashboard. The single most useful thing it demonstrates is a negative: that detection sensitivity was not quietly lowered in the run-up to a production.

Team controls

On Pro, from two seats, administrators can additionally:

Require export records, so members cannot disable the server-side trail
Require verification certificates on every export
Require an exemption code on every redaction
Lock attribution to email, account reference, or hidden
Control history visibility - organization-wide certificate history for all members, or administrators only

Each of those policy changes is itself logged.

What's Available on Each Plan

Capability	Trial	Core	Pro
Redaction log (in-PDF table and CSV)	Yes	-	Yes
Export records and Certificate History	Yes	-	Yes
Settings history and CSV export	Yes	-	Yes
Exemption codes in the `Code` column	Yes	-	Yes
Bates numbering	Yes	-	Yes
Organization-wide history and policy locks	-	-	Yes(2+ seats)

Core exports do not include certificates or an audit trail - the redaction log, export records and settings history are all Pro features. The one-document trial includes the full audit trail so you can see exactly what a Pro export produces. Full detail on compare plans.

What We Store, and For How Long

Record	Where it is held	Retention
Your document and its text	Your device only - never transmitted	Never held by us
Redaction log CSV	Generated in your browser, written into your export	Never held by us
Export records (hashes, counts, signature, timestamps)	Our database	Life of the account
Settings and policy history	Our database	Life of the account

Deleting your account cascade-deletes every export record and history entry attached to it. There is no separate retention clock and no archival copy. If you need records to outlive the account - and under most federal and state records schedules you will - export the settings history to CSV and keep the verify.json files from your exports. Those verify offline, indefinitely, with no dependency on us.

What the Audit Trail Does Not Prove

Not that the redactions were correct. The log records what kind of data you removed, not whether the exemption was properly claimed - or whether something should have been withheld and was not.
Not what you chose not to redact. Text you never flagged leaves no trace in the log, by definition. The trail is evidence of process, not of completeness.
Not verified identity. Attribution names the account that produced the export. It is not a checked identity claim about the person at the keyboard.
Not a case management system. It records what RedactProof did. Your reasoning, approvals and correspondence belong in your own production log or matter file.

Verification certificates and audit records provide evidence of document handling. They do not replace professional judgment, and they are not in themselves a finding of regulatory compliance. Consult your legal or privacy team on what your specific production requires.

Frequently Asked Questions

Does RedactProof produce an audit trail for PDF redaction?

Yes, on Pro and on the one-document trial. Every export produces three separate records: a per-redaction log listing the category of each item withheld with its page, exemption code and detection source; an export record holding SHA-256 hashes of the original and redacted files with an Ed25519 signature; and a settings history recording every change to your redaction configuration. The first travels with the document, the other two stay in your account. Core does not include the audit trail - see Plan Availability below.

Can I produce a redaction log for a FOIA response or discovery production?

Yes. The per-redaction log records one row per redaction with its reference ID, page number, exemption code and the code description, which is the withholding log format FOIA responses and Vaughn-style indexes are built from. Enabling Bates numbering stamps every page and makes the log mandatory, so each entry can be tied to a specific Bates number in the production.

Can I export the redaction log into Excel or an eDiscovery platform?

Yes. The redaction log is written as an RFC 4180 CSV with CRLF line endings and a header row, which Excel, Relativity and most eDiscovery tools ingest without conversion. Every row carries a Document and Date column so logs from multiple exports can be concatenated into one master sheet without losing provenance.

Does the audit trail record the contents of my document, or the text that was redacted?

Neither. The redaction log records the category of each item withheld - for example "Redacted email address" - along with its page and reference number, never the value itself. The server-side record holds SHA-256 hashes of the original and redacted files, a count of redactions by category, the page count and a timestamp. Hashes are one-way fingerprints, so nothing can be reconstructed from them, and the document is never uploaded in the first place.

How long are export records kept?

For the life of the account. Deleting your account cascade-deletes every certificate record, settings history entry and terms acceptance associated with it. There is no separate retention clock and no archival copy.

Can a team administrator see everyone’s redaction history?

On Pro, from two seats, administrators see an organization-wide certificate history. A policy setting controls whether that history is visible to all members or to administrators only. Administrators can also require export records so members cannot disable them.

Audit Trail for PDF Redaction: FOIA and Discovery