Court-defensible redaction with a signed audit trail.

After the redactions are burned in, the exported file is re-opened and re-examined to confirm the removed text is genuinely absent from the output — not merely covered. The check runs on the bytes that were actually written, so it tests the file you are about to send rather than the editor's intention.

You are told, plainly, rather than handed a file that looks finished. A redaction workflow whose failure mode is silent is worse than no workflow, because the user's confidence is highest at exactly the moment the document is least safe.

No. The file is opened, processed and saved back by code running in this browser tab — there is no upload endpoint on our servers to send it to. You can watch the Network panel in your browser's developer tools while you work and confirm nothing carrying the document leaves the page.

Verifiable Redaction is part of PDFMacro Pro. You can read what it does and open the tool on any plan; running it requires a subscription. Marking and burning redaction boxes is free. The verification gate and the Certificate of Redaction are the paid part.

Yes. Once the page has loaded, every tool keeps working with the network disconnected, because the processing never depended on a server round-trip. AI features that use an on-device model need one download the first time; after that they run offline too.