The most common way a redacted document leaks is also the most invisible: the file looks correct on every screen it is opened on, clears review, gets sent — and the text comes straight back out of any parser. Here is why that happens, how to redact so nothing survives, and the one command that settles it.
Talk to our technical team → — for integration questions, a security review or a volume estimate.
A PDF holds two separate things. The content stream carries the text as data — character codes, positions, font references. The appearance is a set of drawing instructions layered over it.
Almost every tool that offers to redact a PDF adds a filled rectangle to the second one. Nothing touches the first. The characters are still in the file, at the same coordinates, in the same order. They are selectable with a mouse, copyable to a clipboard, and returned in full by any library that reads a PDF.
This is not an obscure edge case. It is the default behaviour of annotation tools, of “markup” features in PDF viewers, and of a great deal of software sold specifically for redaction. The failure is invisible precisely because the document renders correctly, which is why it survives review and gets sent.
Ten seconds, and it settles the question for any tool, including ours.
pdftotext redacted.pdf - | grep "1234"
If the value you redacted comes back, the redaction is cosmetic. There is no interpretation needed and no vendor claim that outweighs it.
Two variations worth running as well, because they catch different failures:
pdfinfo -meta. A page can be correctly redacted while XMP metadata still carries the value.Two approaches survive the test, and they suit different needs.
Rasterising is what our redaction endpoint does, and the trade is worth stating plainly rather than burying: the output is no longer selectable or searchable anywhere in the document, and file size usually rises. If your archive depends on full-text search over these files, that changes your indexing story.
That trade is unavoidable rather than an implementation shortcut. A PDF that is still searchable in the redacted region is a PDF where the redacted text is still present. You cannot have both, and any vendor offering both is offering you the annotation.
One call, document in and document out, rasterised so nothing survives the test above:
curl -X POST https://api.maskaadhaar.com/api/v1/redact-pii \ -H "X-API-Key: $MASKAADHAAR_KEY" \ -F "file=@document.pdf" \ --output redacted.pdf pdftotext redacted.pdf - | grep "1234" # nothing
The response reports how many regions were covered and a count by type — never the values found, because a header carrying the identifier it just redacted would put that identifier into every access log and proxy between us and you.
Which identifiers it looks for is up to you. The defaults are the
Indian set, because that is where this product started; types=global switches to
IBAN, payment cards, VAT numbers, UK National Insurance numbers and E.164 phone numbers
instead. The full list, with the checksum each one is validated against, is on the
identifier reference.
A PDF stores its text as data and its appearance as drawing instructions. A filled rectangle is an appearance change only. The characters underneath are untouched in the file, so they remain selectable, copyable and returned by any parser.
Run pdftotext on the output and search the result for the value you redacted. If it appears, the redaction is cosmetic. This takes one command, settles the question definitively, and is the test an auditor or opposing counsel will run.
Not reliably. Flattening merges annotation layers but many implementations preserve the underlying text objects, so the content stream can still contain the characters. Rasterising the page removes the text objects because the page becomes an image.
Text is no longer selectable or searchable anywhere in the document, not just in the redacted region, and file size usually increases. That trade is unavoidable: a PDF that remains searchable in the redacted region is one where the redacted text is still present.
No, and it is a separate problem. Metadata, attachments, bookmarks and revision history can each carry the value independently of the page content, so a document can be correctly redacted on the page and still leak through XMP metadata or an embedded attachment.
Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.