Security-first PDF redaction
Your documents are processed locally in your browser. Nothing is uploaded by default. Server-side storage is limited to content-free metadata: cryptographic hashes for tamper-evident verification and, for optional saved sessions and team workflows, redaction coordinates and categories - never documents, text or filenames.
Client-side processing
Documents are processed in your browser using WebAssembly and local AI models
No file uploads
Your PDF files never leave your device. The opt-in Precision Engine sends only extracted text, never files.
Tamper-evident exports
Ed25519 signatures and SHA-256 hashes verify redaction integrity
No upload by default - what stays local
This section describes the Standard Engine - the default detection mode on every plan. The cloud-assisted Precision Engine is opt-in and covered in the next section.
When you open a document in RedactProof, everything happens inside your browser. The PDF is rendered, text is extracted, and PII detection runs locally - using pattern matching on every plan, and an on-device AI model on paid plans.
This means your document content is never transmitted over the network. There is no server-side processing of your files. The browser tab is the boundary.
Stays on your device
- Original PDF files
- Extracted text content
- Detection results
- Redacted output files
- AI model weights (cached in browser)
Sent to our servers (verification certificates only)
- Cryptographic hash of the redacted file (SHA-256)
- Certificate metadata (timestamp, entity counts)
- Your email for certificate attribution
Hashes are one-way - the original content cannot be reconstructed from them.
Two detection engines, different trust models
RedactProof offers two levels of PII detection. Both include unlimited pattern-based recognition (emails, phone numbers, Social Security numbers, and more). The difference is how the two detection engines work. For a plain statement of what detection does and doesn't cover, see detection coverage & limitations.
Fully on-device
AI detection runs entirely in your browser using a local AI model. No text is sent anywhere. Ideal when documents cannot leave your network under any circumstances.
- Zero network requests
- Works offline after first load
- Pattern + AI detection combined
Cloud-assisted (opt-in, text only)
An optional upgrade you choose to enable. Extracted text - not the PDF file - is routed through Cloudflare Workers AI for enhanced detection. Text is processed in memory, never persisted, and never used for model training.
- Only extracted text sent (not files)
- Processed in memory, not stored
- Cloudflare infrastructure (data privacy-compliant)
See our privacy policy for details on data processing locations.
What is stored server-side and why
RedactProof stores the minimum data needed to operate the service. Document content is never stored on our servers.
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account authentication and certificate attribution | Until account deletion |
| SHA-256 hashes (original + redacted file) | Tamper-evident verification - proves which document was redacted and that the output has not been modified since | Until account deletion |
| Certificate metadata | Timestamp, entity counts, certificate ID for QR verification | Until account deletion |
| Subscription data | Plan tier, billing status (via Stripe) | Until account deletion |
Hashes and encryption, explained
Two terms get conflated when people read "hash" - so it is worth being precise about what we do, and what we don't.
What a hash actually is
A hash is a short, fixed-length fingerprint of an entire file. Run the same file through SHA-256 and you always get the same 64-character string back. Change a single byte and the entire hash changes.
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
- Calculated once over the whole file - not over its contents continuously
- One-way: you cannot reverse a hash back into the document
- We store one hash for the original and one for the redacted output, so verification can prove a specific input produced a specific output and that neither has been altered since
A hash is not encryption. There is no key, nothing to decrypt - it is a fingerprint, not a locked box.
Encryption we do use
- In transit: all traffic between your browser and our servers runs over TLS 1.3 (HTTPS). That covers account data, hash submission, and Precision Engine text.
- At rest: the small amount of account data we hold (email, hashes, certificate metadata) sits in Cloudflare D1 and R2, both encrypted at rest by Cloudflare's infrastructure.
Why we don't offer end-to-end encryption
E2EE solves a specific problem: data passing through a server you would rather not trust. Our architecture removes that problem at the source - your document content never leaves your device, so there is nothing for end-to-end encryption to protect that on-device processing isn't already protecting more directly.
Put plainly: you cannot lose data we never receive.
What this architecture prevents
Server-side data breach
If our servers were compromised, attackers would find hashes and metadata - not documents. There is no document content to exfiltrate.
Man-in-the-middle interception
Standard engine users transmit zero document data. Precision Engine users transmit only extracted text, encrypted in transit via TLS.
Insider access
Our team cannot access your documents because we never receive them. Database access shows hashes, not content.
Redaction tampering
Ed25519 digital signatures and SHA-256 hashes on verification certificates detect any modification to redacted exports.
Permanent redaction via pixel-burn
RedactProof uses pixel-burn redaction rather than overlay-based redaction. Each page is rendered to a raster image, redaction boxes are burned into the pixels, and a new PDF is generated from the result.
This means the original text beneath a redaction is physically destroyed - it cannot be recovered by removing an annotation layer, copying text, or inspecting the PDF structure. The redaction is irreversible by design.
Learn more about the difference in our guide: Overlay vs pixel-burn redaction.
Every export is also checked automatically before download - a routine part of the export process, not a periodic audit. After generating the redacted PDF, the application independently re-opens it and confirms that no text remains within any redacted area and that no form fields survive. An export that fails this check is withheld rather than delivered.
Independent recovery testing
We don't just claim irreversibility - we test it. Files exported through the real redaction pipeline are attacked with recovery tools that share no code with RedactProof: three independent PDF parsers (xpdf, pypdf, and Chromium's PDFium), a raw byte-level search of the file including decompressed streams, a structural inspection for surviving form fields, annotations and metadata, and an OCR pass that tries to read text back out of the redacted pixels. These tests are part of our engineering release process, separate from the per-export check above: they are re-run whenever the export pipeline changes, and a failure blocks release of that change.
| Test date | Scope | Outcome | Report |
|---|---|---|---|
| 25 July 2026 | Free and paid export paths; 6 recovery engines | Pass - 0 redacted strings recovered | Full report |
Showing the five most recent verification runs. Earlier reports remain available at their original URLs.
Certifications and registrations
RedactProof (operated by Popsall Ltd) is Cyber Essentials certified - the UK government-backed baseline security scheme run by the NCSC and IASME - with whole-organization scope, certified July 2026 and renewed annually. The badge is served live by the certification registry, so it always reflects current status; you can also open the certificate entry to verify it directly.
We are registered with the UK's data protection regulator, the Information Commissioner's Office - registration ZC164232 on the ICO register.
Popsall Ltd holds professional indemnity and cyber security insurance; evidence of cover is available on request. Our infrastructure provider, Cloudflare, holds its own ISO 27001 and SOC 2 certifications.
Frequently asked questions
Can I use RedactProof offline?
After the initial page load (which downloads the app and AI model), the standard detection engine works without an internet connection. You will need connectivity for certificate generation and the Precision Engine.
Where is my data stored?
Document files stay in your browser and are never uploaded. Account data and certificate hashes are stored on Cloudflare's infrastructure. Precision Engine text processing uses Cloudflare Workers AI. See our privacy policy for full details.
Is RedactProof suitable for data privacy-regulated documents?
RedactProof is designed with North American privacy laws (CCPA, PIPEDA, and state regulations) compliance in mind. Client-side processing means document content is not shared with us, which simplifies your data processing obligations. Verification certificates provide an auditable record of redaction for compliance purposes.
Does RedactProof hold any security certifications?
Yes. RedactProof (operated by Popsall Ltd) is Cyber Essentials certified - the UK government-backed security scheme run by the NCSC and IASME - with whole-organization scope, certified July 2026 and recertified annually. We're also registered with the UK's data protection regulator, the ICO (registration ZC164232). Our infrastructure providers carry their own certifications: Cloudflare is ISO 27001 and SOC 2 certified.
What happens if I delete my account?
All server-side data is permanently deleted, including your email, certificate records, and subscription data. Since we never store your documents, there are no files to delete on our end.
How does certificate verification work?
When you export a redacted document, RedactProof generates an Ed25519 digital signature and SHA-256 hash. Recipients can verify the document has not been tampered with by scanning the QR code on the certificate page, uploading the file, or entering the certificate ID. Learn more in our verification documentation.
Try it in your browser
No installation. No upload. Open a PDF and start redacting.