Secret Chat Logo

How to Redact Documents Before Uploading Them to Any AI
Remove the Data, Keep the Useful Structure

Launch Private Chat

Published September 18, 2026

This article is general information, not legal advice. For advice about your own situation, consult a qualified lawyer.

To redact a document before uploading it to an AI, remove the data from the content instead of covering it, replace identifiers with consistent placeholders, and generalize details that identify someone when combined. Strip the metadata, verify the result with select-all and copy, then send it through a channel that does not know who you are.

That last check matters because a document has at least two audiences: the person looking at the page and the software reading the file. A black rectangle can satisfy the first while leaving the second a perfect copy of the words underneath.

Why Most Redaction Fails: Covering Is Not Removing

In January 2019, a filing by Paul Manafort's lawyers appeared to hide passages behind black bars. Readers could select the covered material, copy it, and paste the text elsewhere. The filing thereby exposed allegations that Manafort had shared polling data with Konstantin Kilimnik. The mistake was ordinary: an overlay changed the page's appearance without excising its content.

The failure need not leave literal text behind. When a 2016 deposition of Ghislaine Maxwell was unsealed in October 2020, its alphabetical word index remained at the end. Names were obscured, but their positions among visible index entries, page references, and repeated appearances gave readers enough structure to infer some of them. The page had been cleaned visually while the document still described what the black bars concealed.

Nor is a distortion necessarily destruction. In 2007, German police computer experts reversed a swirl applied to a suspect's face. The restored image supported a public identification appeal. INTERPOL launched its public appeal on 8 October 2007; Christopher Paul Neil was arrested in Thailand on 19 October. In 2020, the open-source Depix project demonstrated a narrower version of the same lesson for text. It can recover text pixelated with a linear box filter when the user can reproduce the relevant font and rendering settings. Pixelation discards detail, but not always enough.

A 2023 paper by Maxwell Bland, Anushya Iyer, and Kirill Levchenko found a less obvious leak. Story Beyond the Eye: Glyph Positions Break PDF Text Redaction examined 11 popular PDF redaction tools. Even when a tool removed the letters, the spacing and glyph-position adjustments left in the PDF could narrow the hidden word. In the RECAP mirror of PACER, the researchers also found 6,541 nonexcised redacted names in 710 US court documents. In public-document corpora, the researchers automatically attacked more than 300 vulnerable excising redactions of names and located thousands of potentially vulnerable ones. Their result is a useful correction to the usual advice: successful copy-and-paste verification is necessary, but it cannot detect every structural clue in a PDF.

What Counts as Identifying Information?

Direct identifiers are the easy column: a full name, account number, email address, phone number, face, signature, or employee ID. Quasi-identifiers are facts that may be common alone but identifying together. A profession, a small town, an unusual incident, and an approximate date can point to one person even after the name is gone.

Latanya Sweeney's study of 1990 US Census summary data, published in 2000, estimated that 87% of the US population was likely unique on the combination of five-digit ZIP code, date of birth, and sex. Philippe Golle revisited the estimate with 2000 Census data in 2006 and produced a lower estimate of 63%. The percentage changed; the practical point did not. Removing one obvious field does little if the remaining combination has only one plausible owner.

The HIPAA Safe Harbor method at 45 CFR §164.514(b)(2) supplies a useful checklist even outside healthcare. It names 18 identifier types: names; fine-grained geography; dates tied to a person; phone and fax numbers; email addresses; Social Security, medical-record, health-plan, account, and certificate or license numbers; vehicle and device identifiers; URLs; IP addresses; biometric identifiers; full-face images; and other unique identifying numbers, characteristics, or codes. Dates are reduced to the year. Ages over 89 are grouped as 90 or older. ZIP codes are reduced to the first three digits only where the combined area has more than 20,000 people; otherwise those digits become 000.

Use that as a prompt for inspection, not as a promise about your file. HIPAA binds covered entities and their business associates, and its de-identification rule concerns protected health information. It does not regulate every person who happens to possess health data, and the list cannot tell you whether a distinctive story identifies someone in your actual audience.

European law draws another boundary. GDPR Article 4(1) defines personal data broadly as information relating to an identified or identifiable natural person. Article 4(5) defines pseudonymisation as separating the additional information needed to attribute data to a person. Pseudonymised data remains personal data.

The EDPB adopted Guidelines 02/2026 on Anonymisation at its 7 July 2026 plenary; the draft is open for consultation through 30 October 2026. Its technical framework asks whether the data resists record isolation, linkage, and inference, taking account of means reasonably likely to be used by relevant people. For an AI upload, redaction is a practical discipline aimed at the particular document you send. It is not a claim that the result has become anonymous in the GDPR's term-of-art sense.

Where Data Hides, Format by Format

PDF. Use an actual redaction command, apply the redactions, sanitize hidden information, and save a new output. Adobe Acrobat Pro separates Redact from Sanitize because visible content and metadata are different problems. Apple's Preview gained its Redact tool in macOS Big Sur in 2020; the redaction becomes permanent when the document is closed. Preview removes the words on the page, but not a table of contents that links to them, and an index that still names what the page no longer shows is the same class of leak that gave away the Maxwell deposition. LibreOffice added document redaction in version 6.3 (August 2019) and Auto-Redact, which marks text by string or regular expression, in version 6.4 (January 2020). Use the dedicated Redacted Export command, not a drawing tool that merely places a shape on top.

A PDF may contain selectable text behind an image, including an OCR layer beneath a scan. It may also carry comments, bookmarks, embedded attachments, form-field values, scripts, layers, and a document information dictionary with fields such as Author, Title, Subject, Keywords, and Creator. Flatten or export the redacted result through the tool's intended workflow, then open the new file in a different viewer. Press select-all, copy, and paste into a plain-text editor. Search for every removed name and number. Inspect document properties and attachments separately. For a scanned page, remember that OCR may rediscover text from the visible pixels even when no text layer exists.

Word. Word has no native true-redaction feature. Work on a copy. Replace identifiers in the source text with placeholders, accept or reject tracked changes deliberately, and use File → Info → Check for Issues → Inspect Document. Review comments, revisions, hidden text, headers and footers, and document properties. Then copy the cleaned content into a fresh file or export it, and inspect that output again. Black highlighting, a text box, or a rectangle is decoration, not deletion.

Excel. Start by making every sheet visible. Excel also supports VeryHidden sheets that do not appear in the ordinary Unhide dialog, so inspect the workbook structure or VBA properties where appropriate. Check hidden rows and columns, comments and notes, named ranges, external links, embedded objects, filters, and formulas whose displayed result conceals a revealing source. PivotTables and related business-intelligence features can retain source rows in caches. Microsoft's Document Inspector finds items such as PivotTables, external links, and embedded objects, but by design does not remove them because doing so could stop the workbook from working properly. A clean deliverable is often a new workbook containing only the necessary values.

PowerPoint. Read the speaker notes, hidden slides, comments, revision information, off-slide objects, slide masters, and document properties. Cropping a picture normally leaves the cropped pixels in the presentation. In the desktop app, select Compress Pictures and then Delete cropped areas of pictures. If you need only the words, consider exporting just those words to a new document instead of sending the deck.

Images and screenshots. Blur and pixelation are transformations, not reliable removal. Put an opaque box over the sensitive pixels and export a new raster image so the box becomes part of the pixels. Reopen that exported file rather than trusting the editor canvas. Check the edges for browser tabs, filenames, usernames, notification banners, a taskbar clock, faces, reflections, and a recognizable location. Then remove file metadata; our separate guide explains what EXIF and document metadata can reveal.

Email and chat exports. Delete routing headers, addresses, signatures, quoted threads, forwarding history, ticket numbers, avatars, and timestamps that are not needed for the task. A one-line reply may sit above five years of quoted correspondence. Redact the entire export, not just the newest message.

Use a Placeholder Ledger

Before editing, make a small local key: “Maya Chen → Employee A,” “Northwind Labs → Company 1,” “14 March 2026 → Date 1.” Keep that ledger only on your device. Never attach it or paste it into the chat. Consistency lets the model follow who promised what without knowing the real names.

Generalize details when the model needs their shape. Change a city to a region, an exact amount to a rounded band, a day to a month, and a distinctive job title to a seniority level. Do not erase every relationship. “Client A rejected Company 1's revision three days later” is analytically useful; a page filled with identical black bars is not. Ask the model to work with placeholders, then put the real names and figures back yourself in your local copy.

The hard check is social, not technical: would a colleague recognize this person? “The only left-handed surgeon in a town of 8,000” has no conventional identifier and may still identify one person at once. Watch small populations, rare combinations, unique disputes, and facts that appeared in public posts. If a detail is not necessary for the answer, remove it. If it is necessary, widen it until several people or organizations plausibly fit.

  1. Duplicate the original and preserve it locally.
  2. Create the placeholder ledger and replace direct identifiers consistently.
  3. Generalize quasi-identifiers while preserving relationships the task needs.
  4. Inspect hidden content and metadata for that file format.
  5. Export a fresh deliverable through a true redaction workflow.
  6. Reopen it, select all, copy to plain text, search for the originals, and inspect the visible edges.
  7. Send only the minimum excerpt or pages needed, through a channel that does not attach your identity to the request.

Do Not Ask a Cloud AI to Perform the First Redaction

Sending the unredacted document to a cloud model with “please remove the personal data” already makes the disclosure. If automation is necessary, run that first pass on your own device with a local model, then review every result yourself.

A second pass on material you have already redacted is useful because a fresh reader can spot combinations you missed. Make it list risks before it answers the document's substantive question:

Before doing anything else with this text, list every remaining detail that could identify a person, company, or place, whether alone or in combination. For each detail, explain how someone could use it to single out, link to, or infer the identity. Do not solve, summarize, rewrite, or analyze the document until you have completed that identification review. Here is the document:

What Redaction Cannot Remove

Wording can itself be evidence. Vocabulary, punctuation, repeated phrases, and habits of structure can corroborate an identification made from stronger clues. As our guide to AI chatbot fingerprinting explains, stylometry works better as corroboration than as the source of an identity, especially on short samples.

Redaction is also per-document while a conversation accumulates. “Company 1” in one message can become recognizable after later messages reveal its city, product, and dispute. Start a separate conversation where possible, minimize background, and review the whole thread's combined facts before adding the next attachment.

Finally, a model can infer what was removed. A contract clause may make the jurisdiction obvious; a salary band plus a rare title may expose the employer; grammar around a blank may reveal sex or number. You are controlling the evidence, not the model's conclusions. When the remaining context makes only one answer plausible, a black bar has not bought much.

How Secret Chat AI Handles Documents

Secret Chat AI removes you from your queries — it does not remove the data from your messages. It is an anonymizer, not a content filter. It never redacts attachment content for you. Redacting identifying details is your responsibility, and if you paste someone else's personal data, you are responsible for that disclosure.

“Anonymously” describes the link, not the words: no account identifier travels with your prompt. The request reaches the model provider through our gateway, under our credentials, from our servers — not your name, account, IP address, browser or device. Registration takes an email used only for account access and payment; queries are never stored against it or associated with it. We build no profile of you, no chat is ever associated with you, queries reach the top models anonymously, and queries are never used for training. Whatever a model provider holds under its own terms and configuration, the record on that side carries our gateway's credentials — you use the model as a stranger.

Chats live only in your browser. A prompt exists on our side only long enough to fetch the answer; there is no stored chat archive on our servers. Ordinary infrastructure telemetry, including IP addresses, request timestamps, and error codes, is kept for at most 30 days. It is not a record of what you asked.

Office and text files are extracted on your device. For .docx, .xlsx, .xls, .ods, .pptx, .csv, .tsv, .md, .txt, JSON, HTML, source code, and zip archives containing them, the browser converts the file to plain text. Only that text is sent with the message; the original file never leaves the device. Limits are 10 MB per file, 25 MB per zip, and about 200,000 extracted characters per file. Larger extracted text is cut at that point and marked as cut.

  • Word: body text, headings, lists, tables, footnotes, and endnotes are included. Tracked insertions are included as if accepted; tracked deletions are dropped. Comments, headers, footers, and document properties such as Author and Last modified by are not included.
  • Excel: every sheet, including hidden sheets, is included as CSV under its own heading. Hidden rows and columns are included. A formula travels as its computed value. Document properties do not travel.
  • PowerPoint: text on the slides is included. Speaker notes and comments are not.

Click the attachment before sending to see exactly the extracted text the model will receive. That is your last redaction check. “Not included on Secret Chat” is not “safe to leave in”: another service may extract different parts, and a hidden Excel sheet does travel here.

Images and PDFs take a different path. They go to the model as files through our compression service on our servers; this cleaning does not happen in the browser. Every image is re-encoded with metadata stripped after its orientation is baked into the pixels. Every PDF is rebuilt with Title, Author, Subject, Keywords, and Creator blanked. The intermediate copy is deleted as soon as the result is collected, with an hourly sweep. The content remains untouched. A black rectangle added as a PDF annotation can leave the text underneath in the file, and a photo of a whiteboard still shows the whiteboard.

The AI Council sends one question to models from several companies and has a referee compare their answers. That widens where the text travels because every provider on the panel receives it, so redaction matters more. No council panel accepts a PDF, and the free pair accepts no images.

The Document generator deliberately has no “parties and details” form. A form asking for tax IDs, bank details, and addresses would invite the data the product is designed to keep away from providers. Parties and figures come from your request or an attachment when you choose to supply them; anything missing is written as a [___] blank for completion in Word. There is deliberately no PDF export for Documents, so the app does not produce a finished-looking file with those blanks filled inside it.

Frequently Asked Questions

  1. Does drawing a black box over text in a PDF redact it?

    No. A rectangle may be an annotation over selectable text. Use a true redaction tool, apply the redaction, sanitize hidden content, save a new file, and test the result by selecting and copying its contents.

  2. Is blurring or pixelating text enough?

    No. Pixelation and blur preserve transformed information, and tools such as Depix can recover some pixelated text under the right conditions. Replace sensitive pixels with an opaque block and export a new raster image.

  3. Can I ask ChatGPT or Claude to redact a document for me?

    Not for the first pass if that requires sending the original to their cloud services. The upload itself discloses the unredacted content. Use a local process first, then ask a cloud model to inspect the already-redacted version for details you missed.

  4. What are the HIPAA Safe Harbor identifiers, and is the list useful outside healthcare?

    They are 18 types covering names, detailed geography and dates, contact details, official and account numbers, device and vehicle identifiers, URLs and IP addresses, biometrics, faces, and other unique codes or characteristics. The list is a useful inspection checklist for anyone, but HIPAA itself applies to covered entities and business associates handling protected health information.

  5. Does redacting a document make it anonymous under the GDPR?

    Not by itself. Pseudonymised data is still personal data. The harder question is whether anyone with means reasonably likely to be used could isolate a person, link the data to other information, or infer an identity from what remains.

  6. Does Secret Chat AI redact my documents for me?

    No. It removes you from the request, not the data from the document. For Office and text attachments, it shows you the exact extracted text before sending so you can perform the final check; images and PDFs keep their visible content.

Conclusion

The dependable rule is physical removal. Replace names in the source, generalize identifying combinations, inspect the format's hidden compartments, export a new file, and try to recover what you meant to remove. If you can still select it, search it, unhide it, or infer it from one unusually specific detail, the work is not finished.

Then separate two questions. Redaction controls what the words reveal. An identity-separating gateway controls who the request says you are. You need both when the content and the person asking could identify each other.

Related reading: EXIF and metadata in uploaded files; prompt injection in uploaded files; checking work messages before sending; what prompt metadata reveals; and a threat model for telling AI secrets.

Sources