Reversible redaction replaces each name or identifier with a code and keeps the map from codes to originals on your own machine. You send the document out with the identities gone. When you need them back, you decode it yourself. It suits files sent to an expert, a vendor or a second reviewer under a confidentiality agreement.
Why one-way redaction is not always enough
Permanent removal is right when a document goes into the public record and must never be recovered. Most work needs something in between:
- A contract must reach a vendor or an expert with the names out, while your side still knows who is who.
- The same person appears on forty pages, and their code must mean that person on all forty.
- A third party analyses the file, and you must map their findings back to the real people afterwards.
A black box makes all three impossible, for everyone, including you.
How it works
A tokenising tool finds the personal data, such as names, addresses and Social Security numbers. It replaces each value with a code. Within a folder, the same value always gets the same code, so the document still reads as a document.
The tool records each pair in the Code Registry, a file on your own disk. When you need the real values back, it decodes them on your machine.
What a code looks like
A code is a bracketed string. Its first letter gives the type: P for a person, A for an address, E for an email, S for a Social Security number. An eleven-character name might become [P0ABCD].
The code's length tracks the text it replaces. Each filler character also matches the width of the character it stands in for. A fixed-length placeholder would overflow a table cell or leave a gap in a signature block.
Codes are scoped to a folder
A code is stable within a folder. Each folder is its own namespace, and its codes are invisible to other folders. Our own marketing once claimed one code across the whole library, in seven languages, until we checked it against the software.
- A limit. Split a matter across two folders and the same person carries two codes. So you cannot use a code as a lasting reference across archives or in letters. To keep one code across folders, add it by hand in Settings, under Codes, with Add a code. A code added there is global on purpose.
- A protection. Without your registry, a code is worth little to whoever finds the file. And because the same person gets a different code in each folder, a code taken from one case reveals nothing about another.
Reversible vs permanent
| Property | Permanent removal | Reversible code |
|---|---|---|
| The underlying text | Gone from the file | Replaced by a code, map kept locally |
| Can you recover identities? | No, by design | Yes, on your own machine |
| Stable for one entity | Not applicable | Within the folder you are working in |
| Legal status in Europe | Can count as anonymisation | Pseudonymisation, still personal data |
| Best for | Public filings, final disclosure | Vendor and expert review, analysis you get back |
Neither is better; they serve different purposes. You choose for each value: a client's name may need to come back, while bank details rarely do.
Where the map is kept, and the export risk
A map kept in a cloud service puts your data back on someone else's server, as redacting legal PDFs without the cloud explains. Our registry is a local file, deliberately not encrypted. The unredacted original already sits on the same disk, so encryption would add no protection.
The real risk is the export. The registry can be exported as plain text that lists each code against its original, which helps when a colleague needs the mapping. But a document sent with its export is not redacted at all, because the recipient holds both halves. Keep it away from the document, and out of support bundles and logs.
Frequently asked questions
Is tokenised data still personal data?
Yes, while you hold the map. In Europe and the UK, regulators treat reversible codes as pseudonymisation, so every duty still applies. What actually counts as anonymised explains the difference.
Can two different people get the same code?
No. Every code in your Code Registry is unique, in every folder. What changes between folders is the other direction: the same person gets a different code in each one.
Where is the reverse key stored?
On your own machine, in a local file. A tool that keeps it on a server trades away the privacy you wanted.
What happens if I export the map?
You get a plain-text list that can fully de-anonymise the output. Never send it with the document.
In short
promptShield lets you choose, for each value, between permanent removal and a reversible code. The map stays on your disk, and decoding happens there too. Try it on your own document.