Keep the file on your own machine, and use a tool that removes the text rather than drawing over it. Uploading a privileged document to an online redaction tool puts a copy on someone else's servers. For most legal work, that alone is a breach.
Why a cloud tool is the wrong choice
Most online redaction tools process your file on their servers. That is fine for a restaurant menu, and a problem for a deposition transcript, a settlement agreement or medical records.
- Confidentiality and privilege. Once the file leaves your device, a third party has it. Under professional rules such as state bar rules, that can breach your duty even if nothing leaks.
- Data protection. A vendor that receives personal data becomes a processor. If the people in the file are in Europe or the UK, you are the controller and need a lawful basis and a written agreement. In the United States, the rules usually come from the engagement letter or a sector law. Few firms arrange this for an ad-hoc tool.
- It cannot be reversed. Deletion policies do not undo a transfer that already happened.
So the answer is to stop uploading the document, whichever vendor you pick.
A black box is not a redaction
Black rectangles drawn over names in a generic editor often leave the text underneath. Anyone can copy it out, or extract it with a short script.
In January 2019, Paul Manafort's defence team filed a court document with failed redactions. Copying the blacked-out passages into another program revealed the text, and the case was widely reported. A competent legal team believed the file was redacted.
Real redaction destroys the content instead of hiding it. It takes three steps:
- Find the text, or the image regions on a scanned page, that hold the personal data.
- Remove that content from the document's text and object layers.
- Put a replacement in its place: a block, a label or a code.
Skipping the second step only makes the page look redacted. The original can also hide in places you do not see: alternate text, metadata, form fields and bookmarks.
How to redact locally, step by step
- Keep the file on your machine. Use a desktop tool, or a browser tool that works in the tab. Then disconnect from the network. If the tool still works, the document is not leaving your machine. A licensed desktop app still checks its licence when it can reach us.
- Detect the personal data. Find-and-highlight works for a two-page letter and fails on a 300-page bundle. Automated detection finds names, addresses, ID numbers, dates of birth, account details, emails and phone numbers.
- Review before you commit. The software flags; you make the call. No local detector is exhaustive, so the file stays locked until you confirm what it found.
- Apply true redaction, then check it. Try to copy text out of the redacted area. If nothing comes out, the redaction is real.
Scanned pages are images and need an extra step first. See how to redact scanned PDFs and images.
What reversible codes are
Plain redaction is one-way. Reversible codes lets you send a document without names while your team still knows who [P0ABCD] is. You can brief opposing counsel, an expert or a vendor, then restore the names internally.
Within one folder, a value keeps its code, so [P0ABCD] is the same person on page 3 and page 280. Keep a matter's files in one folder. A different folder uses different codes, so two matters stay unlinked.
Keeping a map back to the real values is pseudonymisation, not anonymisation. The UK regulator's guidance says pseudonymised data remains personal data, so your data protection duties still apply. Our guide to document anonymisation explains what the word requires.
Our map is a local file, deliberately not encrypted: you already hold the unredacted original on the same disk. Never send an export of the map with the redacted file, because the reader could then restore every name.
Cloud, manual and on-device compared
| Capability | Cloud redaction tools | Manual PDF editor | On-device automated |
|---|---|---|---|
| Document leaves your machine | Yes | No | No |
| Confidentiality exposure | High | Low | Low |
| Removes underlying content | Varies | Often not | Yes |
| Handles a long bundle | Yes | Poorly | Yes |
| Reversible, consistent codes | Rare | No | Yes, within a folder |
| Processes a document offline | No | Yes | Yes |
Frequently asked questions
Is drawing a black box in a PDF editor safe redaction?
Usually not. Unless the tool removes the content beneath, a copy and paste or a script can extract the original. Check by trying to copy from the area.
Does on-device redaction mean lower-quality detection?
Not any more. Detection models now run well on an ordinary laptop. No detector is exhaustive, so review is part of the workflow.
Is a browser-based tool actually private?
Only if it processes the file in the tab and never uploads it. Disconnect from the network and check it still works. That shows the document stays with you, though the page may still make other requests.
How do I redact a scanned PDF?
A scanned page is an image. The tool must recognise the text and its position, cover those pixels and rebuild a readable layer. That process is covered in redacting scanned PDFs.
In short
Use a tool that never asks you to upload the document, and that removes content instead of hiding it. Then copy from the redacted area and see what comes out.
promptShield redacts PDFs and Office files on your own device in the desktop app, and PDFs in the free browser version, and the document never leaves it. Try it on your own document.