Excise PDF

Redaction for records work.

A response package is not one document. It is forty, produced under time pressure, each one going to someone entitled to ask what was withheld and why. Three things follow from that, and they are what this page is about: the claim has to be visible on the page, the record has to be per file, and the tool has to say what it did not check.

The exemption code goes on the page

A rule can carry a code — a (b)(6), a case reference — and it is printed with the replacement, as part of what lands on the page rather than as a note about it. A reader of the redacted document can see which exemption was claimed where, which is the entire point of claiming one.

The receipt tallies them, and it counts stamps rather than applications: a match that a rectangle had already cut out printed no code anywhere, so counting it would assert an exemption that is not on the page. Everything that reasons about the stamped text reads the printed form — the matcher and both self-containment checks included — so a code that itself names the subject is treated as text on the page, because that is what it is.

A folder at a time, with a line for every input

Mac batch mode runs your saved rules over every PDF directly inside a folder you pick, and produces one combined receipt. What that receipt guarantees is the part that matters at volume:

• Every input gets a line — including refusals and failures. A run over forty files that quietly drops the two it could not open and prints a total is how a batch tool comes to be trusted for something it never claimed. Refused and failed both say, in as many words, that nothing was written for that document.
• The headline counts verified, not written: “39 of 40 verified — 1 document needs attention.” A file that was written and did not verify is not a success.
• A scanned page stops its own document, by name — and does not stop the other thirty-nine.
• Each document's own full receipt is included, indented. A summary of a summary is where the detail that mattered goes missing.

The parts of a record that name people without showing them

Records arrive as scans, as exports from case-management systems, as forms somebody filled in. All three carry names outside the page text: document info written by whatever produced the file, form field values, bookmark titles built from a subject's name, attachments travelling inside the document. Twelve categories are removed by default, the audit walks the object graph rather than a checklist of well-known keys, and anything you keep is reported as kept rather than quietly passed.

Then the written file is reopened and read back on two channels, and the receipt states the scope it inspected before what it found — which is the part a reviewer cannot reconstruct from the finished PDF three months later.

Before it goes on a purchase order

• macOS, iPhone and iPad. No Windows, no Linux, no web version, and batch mode is Mac only.
• No server, no API, no command-line tool, no watched folders, no scheduling, no accounts. It does not integrate with a case-management system; it is an app someone runs.
• Nothing is uploaded — the app requests no network entitlement and links no networking framework, which is also what its App Store privacy label rests on. For a records office, that is the deployment question answered in one sentence.
• It certifies nothing. It reports what it inspected in one file, under the settings of that run.

Read next