Redactable
Redactable is a browser-based AI redaction platform that permanently strips names, Social Security numbers, financial data and hidden metadata from PDFs and scanned images, then issues audit-ready certificates for legal, healthcare and government teams.
What is Redactable?
Redactable is a browser-based redaction platform that finds sensitive information in documents and removes it for good. It is published by Redactable Inc., a New York company, and runs entirely online: there is nothing to download, and any team member with a browser can work on the same files. The product handles PDFs, TIFFs, PNGs and JPGs, and a proprietary OCR engine pre-processes scans, correcting rotation, noise and contrast before turning images into searchable text, so paper-based files are treated like any other document.
The core of the tool is the AI Redaction Wizard, which opens automatically with every document and offers four ways of working. Automatic detection scans the whole file and highlights names, identifiers, contact details, dates of birth, Social Security numbers and card data. Category mode sweeps predefined data types in one pass, reads values inside tables and applies facial recognition to blank out faces. Keyword mode searches a word, a phrase or an uploaded list of terms across the document. Manual mode leaves full control, region by region. In every mode the software proposes and the user approves: suggestions are reviewed, previewed and confirmed before anything is applied.
What separates Redactable from drawing black boxes in a PDF editor is what happens next. The selected content is stripped from the file's underlying code, together with hidden metadata, embedded objects and residual data, so it cannot be recovered or reverse-engineered. Each job produces a redaction certificate, timestamps and an audit log; Bates numbering and a privilege log can be generated in the same workflow. Teams collaborate in shared workspaces with role-based permissions, comments, smart tagging and activity tracking, and can bulk-import up to 100 documents from Google Drive, Dropbox, OneDrive, SharePoint, Box or Clio.
The platform runs on AWS with United States data residency, AES-256 encryption validated to FIPS 140-2, TLS 1.2 or higher in transit, zero-trust architecture and mandatory multi-factor authentication. It is SOC 2 Type II certified, audited annually by A-LIGN, HIPAA compliant and aligned with the FBI's CJIS Security Policy. Redactable claims 98% time savings and a 30x speed-up over manual redaction.
What it does
- Detect and permanently remove PII, PHI and financial data from PDFs and images
- Strip hidden metadata, embedded objects and residual data so nothing can be recovered
- Read scanned documents through built-in OCR with image pre-processing
- Redact by AI suggestion, by predefined category, by keyword search or by hand
- Generate redaction certificates, timestamps, audit logs and privilege logs
- Apply Bates numbering and reusable redaction templates before export
- Collaborate in shared workspaces with role-based permissions, comments and activity logs
When to use Redactable / When not to
A quick filter to help you decide if Redactable is the right fit.
When to use Redactable
- Paralegals and litigation support staff preparing court filings, discovery sets and privilege logs
- Public records officers handling FOIA and open-records releases in local, state and federal agencies
- Healthcare administrators and clinical records teams removing PHI from patient files under HIPAA
- Insurance claims adjusters and underwriters redacting policyholder and claims documentation
- Data and AI teams stripping personal information from document sets before model training
When not to use Redactable
- Teams that need to redact Word, Excel or PowerPoint files: only PDF, TIFF, PNG and JPG are supported
- Organisations bound by EU or UK data residency, since all data is stored in the United States
- Developers looking for a documented public API, as API access exists only under an Enterprise contract
- Users who need an offline, desktop or mobile application, because the product runs in the browser only
- Occasional users unwilling to subscribe, the free tier covering only three documents
How to use Redactable
A typical end-to-end flow, from setup to results.
- Create an account at app.redactable.com/signup; no credit card is required
- Upload a document, or bulk import up to 100 files at once
- Alternatively, pull files directly from Google Drive, Dropbox, OneDrive, SharePoint, Box or Clio
- Let the OCR engine pre-process scans, correcting rotation, noise and contrast before recognition
- Let the AI Redaction Wizard scan the document and highlight the sensitive fields it finds
- Or choose another method: predefined categories, keyword and term-list search, or manual selection
- Review the suggestions, tick the items to remove and check the result with Redaction Preview
- Apply the redactions; the content is stripped from the file itself, hidden metadata included
- Add Bates numbering and build a privilege log before export if the matter calls for it
- Download the secured file, with its redaction certificate and audit log generated automatically
Pros & Cons
Pros
- Redaction is permanent: content is removed from the file's underlying code, not covered with a box
- Hidden metadata, embedded objects and residual data are stripped in the same pass
- Compliance is unusually well documented: SOC 2 Type II audited annually by A-LIGN, HIPAA, CJIS alignment and Data Privacy Framework certification
- Built-in OCR handles scans and images, not only text-based PDFs
- Document content is not used to train AI models and is not shared with third-party AI providers
- Certificates, audit trails and privilege logs are produced automatically, with no manual logging
- Nothing to install and no onboarding: the wizard opens with every document and is learned in minutes
Cons
- API access is sold with the Enterprise plan, but no public API documentation is published
- Enterprise pricing is quote-only, so the top tier cannot be budgeted from the website
- Monthly document quotas are tight on the published plans: 15 on Starter, 150 on Pro Plus
- Data is hosted in the United States only, with no EU or UK residency option
- Browser only: no mobile app, no desktop app, no browser extension, and an English-only interface
- No named subprocessor list is published, and the Trust Center returns no content to a plain fetch
- Published figures contradict each other: the file size limit appears as 500 MB, 5000 MB and 3 GB, and the annual toggle shows Starter at $23 per month against $19 monthly
Pricing & Plans
Redactable offers a free tier limited to three redacted documents, which requires no credit card. The lowest paid entry point is the Starter plan at USD 19 per month for up to 15 documents per month. Pro Plus is priced at USD 99 per month for up to 150 documents, Enterprise pricing is provided on request, and a pay-as-you-go option covers occasional documents beyond the free allowance. Annual billing is advertised as 20% cheaper than monthly billing.
- up to 3 redacted documents
- no credit card required
- USD 19 per month
- up to 15 documents per month
- USD 99 per month
- up to 150 documents per month
- quote on request
- covering high volumes
- unlimited OCR
- single sign-on
- priority support
- custom integrations and API access
- pay only for documents redacted beyond the free allowance
Data, GDPR & hosting
A consolidated view of how Redactable handles your data.
GDPR overview
GDPR commitments are explicit. The privacy policy, last updated on 14 December 2025, includes a dedicated GDPR section listing the legal bases relied on — consent, performance of a contract, legal obligation, vital interests, public interest and legitimate interests — and enumerates data subject rights: access, rectification, objection, erasure, portability, withdrawal of consent and complaint to a supervisory authority. Redactable Inc. is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework with the U.S. Department of Commerce, and transfers are covered by contractual clauses or equivalent safeguards. A Data Privacy Officer is designated and reachable at support@redactable.com. The Terms & Conditions of 18 July 2025 treat the privacy policy as the data processing agreement. No Article 27 EU representative is named anywhere on the site.
Who owns the data?
Under the Terms & Conditions, you keep ownership of what you upload: Redactable states that you retain all rights to the content you submit and remain responsible for its legality and for protecting those rights. By posting content you grant the company a licence to use, modify, perform, display, reproduce and distribute it on and through the service, a licence framed around operating the platform. The privacy policy defines controller and processor roles. Redactable also disclaims any duty of storage: it states that it is not responsible for storing information you provide, and that keeping backup copies of your files is your responsibility alone.
Reuse rights
The redacted files you download are yours to reuse, share or archive without asking permission, and you remain responsible for their content. On the vendor side, the security page states that document content is processed in-session, is not retained beyond the redaction job, is never used to train AI models and is never shared with third-party AI providers for training. Account data — name, email address, contact details, account information and usage activity — is processed to provide and improve the service, to answer enquiries, for marketing with consent and to meet legal obligations. Google Analytics and Mixpanel are used for analytics, each with a documented opt-out, and the policy states that personal data is not sold under the CCPA.
Data retention & training
Hosting summary
Redactable runs entirely on Amazon Web Services in private cloud infrastructure, and the vendor states that data is stored in the United States and does not leave the country. The environment uses multi-zone redundancy, so the failure of a single availability zone causes neither data loss nor service interruption, and AWS itself holds SOC 2 Type II certification. Data at rest is encrypted with AES-256 using modules validated to FIPS 140-2; data in transit is protected by TLS 1.2 or higher, with no document content travelling unencrypted at any point of the upload, processing or download workflow. Cryptographic keys are handled by a dedicated key management service covering generation, access control, secure storage, backup and rotation, with access restricted to designated users. Network firewalls and IP restrictions are in place, with DDoS protection provided through AWS Shield and Cloudflare. There is no European or United Kingdom data residency option, and no named list of subprocessors is published.
Things to keep in mind
Risks and trade-offs to weigh before adopting Redactable.
- Automation invites complacency: the wizard only suggests, and a redaction approved without reading it is a disclosure that cannot be taken back
- Redaction is permanent by design, so what is removed from the exported file cannot be recovered from it; decide carefully before approving
- Payments are non-refundable unless separately agreed, and subscriptions renew automatically at the end of each billing cycle
- All data is stored in the United States and may be subject to lawful requests from US courts and law enforcement authorities
- No named subprocessor list is published, so third-party exposure cannot be assessed from the website alone
- Several published figures contradict each other, including file size limits and annual pricing: confirm in writing the terms that matter to you
- Moving privileged or regulated files to any cloud service transfers risk to the vendor's controls; a signed BAA or data processing agreement is still required for HIPAA or GDPR work
Setup & Integrations
Technical difficulty
Setup is minimal. Redactable is a web application: an account is created online, there is nothing to install and no configuration or onboarding session is required. The redaction wizard opens automatically with every document, and one customer reports learning the software in about five minutes. Optional refinements come later: category templates, redaction colours, user roles and permissions, cloud connections to Google Drive, Dropbox, OneDrive, SharePoint, Box or Clio, and single sign-on for Enterprise customers. No technical skills are needed to redact a first document.
Deployment
Integrations
Behind Redactable
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Redactable.
Frequently asked questions
What exactly does Redactable do?
Can a redaction be undone or recovered?
Which file formats are supported?
Is there a free plan, and what do the paid plans cost?
Are my documents used to train AI models?
Where is the data hosted?
Which certifications does Redactable hold?
Are a DPA and a HIPAA BAA available?
Is there an API or a mobile app?
What is the minimum age to use the service?
Should you pick Redactable?
Redactable is a specialist rather than a generalist, and that focus is its main quality: it does one job — removing sensitive content from documents — and does it thoroughly. Redaction is genuine rather than cosmetic, since data is stripped from the file itself along with hidden metadata, and every job leaves a certificate and an audit trail behind it, which is precisely what regulated work requires. Built-in OCR extends that to scans and images, and the review step keeps a human in the loop before anything is applied.
Its compliance groundwork is stronger than the size of the company would suggest: SOC 2 Type II audited annually by A-LIGN, HIPAA compliance, alignment with the CJIS Security Policy, and certification under the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks. The security page is unusually detailed and technical, and the vendor states plainly that document content is never used to train AI models.
The reservations are practical. Data is hosted in the United States only, which rules the platform out where EU or UK residency is mandatory. API access is sold with the Enterprise plan but no public documentation exists. Published plans carry tight monthly document quotas, and several figures on the site contradict each other — the maximum file size appears as 500 MB, 5000 MB and 3 GB, and the annual pricing toggle shows a Starter rate higher than the monthly one. No named subprocessor list is available either.
For legal, healthcare, public-sector, insurance, finance and HR teams that redact regularly, the free tier and the absence of any setup make it inexpensive to test on real documents. Buyers with volume, residency or integration requirements should get the specifics confirmed in writing before committing.
- Choosing a selection results in a full page refresh.
- Opens in a new window.