How it works · in depth

What the receipt actually checks.

After a run, Excise PDF reopens the file it just wrote and reads the report out of those bytes — never out of what the run believed it did. This page is what that report is made of, and what it cannot tell you.

Two engines, because most of a PDF's text is not on the page

A verifier that only re-extracts page text is checking the half of the document a reader can see. So the check is split in two, on a line chosen so the halves neither overlap nor leave a gap:

The evidence that both are needed is in the test corpus, and it is the most useful thing on this page. One fixture extracts as Owner of record: — the page text names nobody — while a form field still holds the name. Another has a page that names nobody at all, a document-info entry naming the subject, and a bookmark titled after the deposition. A verifier built on re-extraction alone passes both of them.

Scope is stated before findings

The receipt opens with what was inspected — pages, objects, strings, which hidden-data categories were checked, and which ones you asked it to keep — and only then says what was found. Scope is the part a reader cannot reconstruct afterwards: “nothing found” means nothing without the sentence above it saying where the looking happened.

The receipt for one file, under one policy — which is the only kind of statement it makes.

A pass is conjunctive

Passing is not “we looked and found nothing.” It is every condition holding at once, and the conditions include the ones where the app could not look:

• Nothing the rules target is still extractable from any page.
• Nothing they target is left in the object graph.
• The areas you drew read back empty at their own coordinates.
• Every match you reviewed was applied. A match you left unchecked is still extractable, so the receipt reports it as extractable rather than forgiving it.
• Every page could be read by something. A page nothing could read leaves a question open.

OCR is an explicitly weaker third channel

A page with no text layer is unanswerable by either engine above. If you asked for OCR, the verifier re-renders that page out of the written file and reads it back with Vision, on device. It is kept apart from the other two on purpose, and the receipt prints the reason next to the result:

The resolution the page was actually read at is printed with it — the lowest, not the average, and measured from the render rather than taken from the setting. A page OCR read nothing from stays unchecked and keeps the document from passing: from here, a blank sheet and a scan too poor to read are the same observation.

What the receipt does not do

• It does not certify anything. It reports what was inspected and what was found, in one file, under the settings of that run. Marketing may quote it; it may not summarise it upward, and neither should you.
• It does not look inside embedded file streams. An attachment is removed whole or kept whole. A policy that keeps them gets a line saying they were kept and how many are present — not a claim about their contents.
• It is not a claim that no forensic route exists. The claim is mechanical and specific: the characters were removed from the content stream, the object graph was sanitized, and the written file was reopened and read back.
• It does not know whether your redactions were the right ones. Which words must go is your decision; the receipt only says what happened to the ones you chose.

Read next