You run a scanned contract through your usual redaction tool, and it cheerfully reports “no personal data found” — on a page full of names. Nothing errored, so you trust it. That silent miss is the single most dangerous failure mode in document redaction, and it happens because a scan is a picture, not text.
Key facts
- A scanned PDF is an image, so text-based redaction tools find no text and can silently report “no personal data found” on a page full of it.
- Redacting a scan requires OCR to locate personal data as regions of the image, then painting over those pixels.
- A proper scanned-redaction pipeline rebuilds a searchable text layer so the redacted document stays usable.
- On-device OCR and redaction keeps sensitive scans — IDs, medical records, signed agreements — off third-party servers.
The short answer
A scanned PDF is an image, not text, so text-based redaction tools find nothing to redact and silently miss everything. To redact a scan you need a tool that runs OCR to locate the personal data as regions of the image, redacts those regions, and ideally rebuilds a searchable text layer. Doing this on-device keeps the scanned originals — often the most sensitive documents you hold — off third-party servers.
Why scanned documents break normal redaction
Open a scanned contract and try to select a word. You can’t — there is no text, just pixels. This is the failure mode that catches people:
- Text-search redaction finds nothing. A tool that redacts by searching for names has no text to search, so it reports “no personal data found” on a page full of it.
- Manual black boxes carry the usual risk — and now you are eyeballing every page by hand.
- The document may still leak via metadata or an attached OCR layer even when the visible page looks clean.
Scans need a fundamentally different pipeline.
The right pipeline for scanned redaction
- OCR the page to recognize the text and, critically, where each word sits on the image (its bounding box).
- Detect personal data in that recognized text — names, IDs, addresses, account numbers.
- Redact the image regions corresponding to those detections — actually painting over the pixels, not overlaying a removable shape.
- Rebuild a clean, searchable text layer so the redacted document stays usable and searchable, minus the removed entities.
Skip step 4 and your “redacted” scan becomes an unsearchable flat image; do steps 1–3 sloppily and you either miss data or over-redact. The underlying principle is the same as for text PDFs: a mark is not redaction unless the content beneath it is gone (see redacting legal PDFs without the cloud).
Why on-device matters even more for scans
Scanned documents are disproportionately the sensitive ones — signed agreements, medical records, ID copies, handwritten notes. Uploading those to a cloud OCR-and-redact service is the highest-stakes version of the problem. On-device OCR and redaction means even your scans never leave your machine.
Frequently asked questions
Why did my redaction tool say “no PII found” on a scanned PDF?
Because it searched for text and the scan has none. You need OCR-based redaction that works on the image itself.
Will redacting a scan make it unsearchable?
Only if the tool doesn’t rebuild a text layer. A good one keeps the document searchable while removing the redacted entities.
Can the removed text still be recovered from a redacted scan?
Not if the pixels are actually painted over and no hidden text layer retains them — which is exactly what a proper on-device pipeline ensures.
The bottom line
If your redaction tool can’t OCR, it can’t redact a scan — it can only tell you, wrongly, that there was nothing to redact. Use a tool that finds personal data as image regions, paints over the pixels, and keeps the result searchable, all on your own device.
promptShield runs OCR, detection, and redaction on scanned PDFs and images entirely on your device, painting over the actual image regions and keeping the result searchable — no upload, even for your most sensitive scans. Try it on your own document.
