Most "redaction" you see in the wild is a lie of omission. Someone drops a black rectangle over a name in a PDF, exports it, and ships it. The rectangle is a drawing sitting on top of the page. The name is still underneath it, intact, in the document's content stream. Anyone can select it, copy it, or run pdftotext and read every character that was supposedly hidden. This has leaked case files, medical records, and settlement figures for years, and it keeps happening because the tools make hiding look identical to removing.
We built Censory to close that gap. When Censory redacts a region, it does not paint over the text — it deletes the underlying content from the exported PDF's content stream. Run pdftotext across a Censory-redacted region and you get nothing back, because there is nothing there. The words are gone from the file, not merely obscured on the screen. That is the whole point, and it is the one property a redaction tool cannot compromise on.
The harder requirement is that everything else has to survive. A redacted document is useless if it becomes a flat image, so Censory keeps the non-redacted text fully selectable and searchable. You remove the four lines that identify a person and the surrounding twelve pages stay live text. Getting that right means operating on the document structure surgically rather than rasterizing the page and calling it done — the lazy path that destroys the document to protect one field.
Detection is where the AI earns its place. An AI model scans images and PDFs for the categories that actually matter — names, emails, national IDs, addresses, faces, signatures — and proposes what to remove. But detection only proposes; the removal step is deterministic and verifiable. We deliberately kept those two concerns separate, because "the model was pretty sure" is not an acceptable answer when the failure mode is a leaked identity. You can always confirm the result mechanically, and we designed the pipeline so that you can.
The last decision was about the original file, and it is a policy decision as much as a technical one. Censory is privacy-first by default: when you finalize a redaction, the uncensored original is deleted. The safest copy of sensitive data is the one that no longer exists on our infrastructure. Too many products treat the pristine original as an asset to retain "just in case" — which is exactly how the thing you redacted leaks anyway, from the backup nobody redacted. Default deletion is the honest default, so that is the default we shipped.
None of this is exotic. It is a set of unglamorous choices — operate on the content stream, keep the rest selectable, separate probabilistic detection from deterministic removal, and delete originals by default — that add up to a tool whose redactions mean what they claim. That gap, between hiding and removing, is where most privacy tooling quietly fails, and closing it honestly is the kind of work we want to be known for.