Modification produces the documents you can safely release: truly redacted, selectively disclosed, watermarked and converted. Redacted regions are removed from the pixels and from the underlying content stream, and every operation writes a log a regulator can read.
Redaction correctness is verified during the Proof of Value against your own documents and your own disclosure policies, including an adversarial check that removed content cannot be recovered from the output file.
Most redaction incidents are not failures of judgement. They are failures of implementation — a rectangle drawn over text that was still sitting in the file.
Regions are rasterised, the underlying glyphs are deleted from the content stream, and metadata, bookmarks, annotations and embedded attachments carrying the same content are stripped before the file is re-written.
Personal and clinical identifiers are detected with coordinates by the identification layer, then removed, masked or partially masked according to policy — a last-four-digits pattern rather than an all-or-nothing choice.
One source document produces different minimal outputs for different recipients, each generated from a named policy rather than from an analyst deciding in the moment what to hide.
Visible watermarks, recipient identifiers, distribution notices and page-level stamps are applied on output, so a leaked copy can be traced back to the disclosure that produced it.
Documents are converted between the formats your downstream systems and archives actually require, including flattening to image-only PDF where a text layer must not survive at all.
Documents split during classification are recombined into a defined pack order with a generated index, so a disclosure bundle arrives as one coherent file rather than nineteen attachments.
Redaction tools that depend on a clean selectable text layer fail on exactly the documents that carry the most sensitive data: photographed forms, wet-ink stamped contracts, faxed medical annexes and handwritten Arabic. DocxIntel redacts from the analysed page, so the presence of a text layer is irrelevant.
If a redaction pipeline only works on native digital PDFs, it does not work on the archive you actually hold.
A motor claim file has to go to an independent repairer. They need the damage assessment and nothing else.
A named policy defines which document classes are included, which data types are removed, which are partially masked, and what watermark the recipient receives. Policies are versioned and reviewable.
The identification layer locates every personal identifier, clinical reference and third-party name in the file, each with a page number, bounding box and confidence score. Nothing relies on a keyword search.
A detection below threshold is not quietly dropped. It is queued with the region highlighted, because the failure mode that matters here is leaving data in, not taking too much out.
Regions are rasterised, glyphs deleted from the content stream, metadata and attachments cleaned, the medical report excluded entirely, and the output watermarked with the repairer name and disclosure date.
An automated check re-extracts text and re-runs detection against the produced file. If any redacted value is still recoverable, the artefact is rejected rather than delivered.
Document, policy version, every redacted region, the triggering data type, the operator, timestamps and hashes of both source and output — append-only, in your own systems, ready for a regulator.
What can be removed, how the removal behaves, and what the service can produce.
Format coverage and policy behaviour for a specific deployment are confirmed in writing during the Proof of Value against your actual document mix and your own disclosure rules.
There are two common ways to get this wrong: hide the data instead of removing it, or remove it correctly on hardware belonging to someone else.
Is the hidden text recoverable
Metadata and attachments cleaned
Works on scans and handwriting
Arabic and bilingual documents
Where personal data is processed
Regulator-ready redaction log
Who can reverse a redaction
Cost of redacting 2M archived pages
Comparison reflects publicly documented behaviour of metered document-processing and redaction products as of 2026, including per-page pricing and enterprise-gated self-hosting. Verify against current vendor documentation before making a decision.
The questions a data protection officer asks before signing off a disclosure process.
A cosmetic redaction draws a black rectangle as an annotation and leaves the original text and image data underneath, recoverable by anyone who selects the region, removes the annotation layer or runs a text dump. DocxIntel rasterises the redacted region, deletes the underlying glyphs from the content stream, strips the corresponding entries from metadata, bookmarks and attachments, and re-writes the file so the removed content is not present in the output at all.
