Trust Center
What Check Before Send checks, what it changes, how the result is verified — and what it does not do.
In short
- What we check
- Photos (JPEG, HEIC, AVIF, PNG, WebP): location, date and time, device and lens, author and copyright, captions and comments, extra pictures stored inside the file. Word documents: author and editor names, company, comments, tracked changes, hidden text, document properties, picture metadata, and emails, phone, card, bank and ID numbers, keys and your own terms in the text. PDFs: the same text checks on every page, plus document information and XMP, comments, attached files, form values, scripts and automatic actions, links, digital signatures and earlier versions kept inside the file. Text and CSV files: the same text checks. Videos (MP4, MOV): the recording location, date and time, device maker, model and software, and the names, titles, descriptions and XMP written into the file.
- What we remove
- Only what you choose — or, in the photo tools, all private metadata we find. Each removal happens in a new copy; your original file is not changed.
- What we keep
- The picture and the document text itself, plus technical data needed to open or display the file: orientation, colour profile, HDR data, camera settings such as exposure and ISO, and formatting.
- What we don't inspect
- Anything visible in a photo (faces, signs, screens — no image recognition). PDF pages that are pictures are read on your device by text recognition, which can miss words, so a scanned PDF is still reported as "Could not fully verify". In a video, the picture is only searched for faces, licence plates and readable text when you use one of the video privacy tools, and those detectors miss things — everything else in the picture, and anything said out loud, is never inspected. Names and addresses are not found automatically (except labelled fields in Chinese documents) — you add them yourself. Encrypted PDFs are checked but not cleaned. Excel, PowerPoint and older Office files are not checked yet. Parts of a file we recognise but cannot read are listed as "Not fully inspected", never counted as checked.
- How verification works
- Check → Clean → Check again → Result. After making the new copy we reopen it and scan it from scratch. "Removal verified" means only that what you removed was not found by that second scan — not that the file is completely safe.
The full technical detail — every capability, how it is verified, and every known limitation — follows below.
Verify that nothing is uploaded
Every tool runs inside this browser tab. Files are read into memory, processed there, and the new copy is handed to your browser as a download.
- Open this site and go to the tool you want to use.
- Open your browser's developer tools (F12, or right-click → Inspect) and choose the Network tab.
- Switch the network to Offline (the throttling menu in Network), or disconnect Wi-Fi.
- Drop a file, review it, and create the new copy. It still works — there is nowhere for the file to go.
- With the network back on, you can also watch the Network tab while processing: no request carries your file.
Usage analytics, if enabled, only ever record event names, counts and fixed categories (for example "payment_card" or "3 files"). They never record file contents, file names, detected values, your custom terms, GPS coordinates, author names, comment text or keys. This rule is enforced in code, not just promised.
How a result is verified: before and after
Every report shows each item next to two columns: what the scan of your file found (the real value, shown only on your device), and what a fresh scan of the new copy found. The tool never trusts its own edits: it re-opens the new copy from scratch and scans it again with the same scanner, searches again for every value you chose to change, and checks that the rest of the file (the picture data, the document structure, the rows and columns) is unchanged.
Items are sorted into privacy information (could identify you — removed by default), technical information (needed to display the file, such as colour profiles or HDR data — kept) and not fully inspected (recognised but not looked inside — never counted as checked). A removal only gets a ✓ when the re-scan no longer finds it. If anything you chose to remove is still found, the report says "Verification failed" and the copy can only be downloaded after a second, explicit confirmation. The report never says a file is "safe".
Formats are recognised from the file's content, not its name. Formats not supported yet (Excel, PowerPoint, older Office files, RAW) are named and left unchanged.
Document Safe-to-Send (.docx): sensitive values
| What | Pack | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|---|
| Email address | International | Yes | Redact / label / pseudonym | Yes | production | Address syntax and boundary rules (RFC 5321 practical subset); file-name look-alikes excluded |
| Payment card number | International | Yes | Redact / label / pseudonym | Yes | production | Issuer prefix + length for Visa/Mastercard/Amex/Discover/JCB/Diners/UnionPay, consistent grouping, Luhn checksum |
| IBAN (bank account) | International | Yes | Redact / label / pseudonym | Yes | production | Country code with registered IBAN length (82 countries) + ISO 7064 MOD-97 checksum |
| IPv4 address | International | Yes | Redact / label / pseudonym | Yes | production | Four dotted octets 0-255, no leading zeros, not part of a longer dotted/word token |
| API key, token, or credential | International | Yes | Redact / label / pseudonym | Yes | production | Only fixed, documented provider signatures: AWS access key id, GitHub tokens, Slack tokens, Stripe keys, Google API key, Anthropic/OpenAI keys, JWT (decoded header must contain alg), user:password@ in URLs |
| Private key (PEM / OpenSSH / PGP block) | International | Yes | Redact / label / pseudonym | Yes | production | BEGIN ... PRIVATE KEY armor header; the whole block through the matching END line is treated as the finding |
| Phone number (international +country format) | International | Yes | Redact / label / pseudonym | Yes | beta | Leading + with a real ITU country calling code and 8-15 total digits (E.164). National formats outside the US/China packs are not detected. |
| Possible secret (keyword assignment) | International | Yes | Redact / label / pseudonym | Yes | beta | A secret-like keyword (api_key, password, token...) assigned a high-entropy value. Heuristic only — always Needs review, never auto-confirmed. |
| US Social Security number | United States | Yes | Redact / label / pseudonym | Yes | production | SSA structure rules (area not 000/666/900-999, group not 00, serial not 0000, known publicly misused numbers excluded). Dashed form detected anywhere; undashed only with an SSN keyword within 40 characters before it. SSNs have no checksum. |
| US / NANP phone number | United States | Yes | Redact / label / pseudonym | Yes | production | NANP numbering plan: area and exchange codes start 2-9 and are not N11 service codes; formatted (parentheses, dash, dot, space, +1) numbers only — bare 10-digit runs are Needs review |
| China resident identity card number | China (mainland) | Yes | Redact / label / pseudonym | Yes | production | 18-character GB 11643-1999 structure: region prefix, real calendar birth date not in the future, ISO 7064 MOD 11-2 check character |
| China mainland mobile number | China (mainland) | Yes | Redact / label / pseudonym | Yes | production | 11 digits starting 13-19 (optional +86/0086), grouped as 3-4-4 or unseparated. Landlines are not detected. |
| China landline number | China (mainland) | Yes | Redact / label / pseudonym | Yes | beta | A real area code (010, 020-029, 03xx-09xx), dash, 7-8 digits; or the same unseparated right after a phone label |
| Bank account number (China) | China (mainland) | Yes | Redact / label / pseudonym | Yes | beta | 12-25 digits directly after an account label (账号, 帐号, 账户, 卡号); no checksum exists for most accounts |
| Unified social credit code (China) | China (mainland) | Yes | Redact / label / pseudonym | Yes | production | 18 characters, GB 32100-2015 structure and check character |
| Organization named in a labelled field (China) | China (mainland) | Yes | Redact / label / pseudonym | Yes | beta | Only where the document labels the field (法定代表人, 委托代理人, 地址, 甲方/乙方 …) |
| Person named in a labelled field (China) | China (mainland) | Yes | Redact / label / pseudonym | Yes | beta | Only where the document labels the field (法定代表人, 委托代理人, 地址, 甲方/乙方 …) |
| Address in a labelled field (China) | China (mainland) | Yes | Redact / label / pseudonym | Yes | beta | Only where the document labels the field (法定代表人, 委托代理人, 地址, 甲方/乙方 …) |
| Custom target (exact / normalized text) | — | Yes | Redact / label / pseudonym | Yes | production | NFKC + dash/quote/space normalization, case-insensitive by default, word-boundary aware for Latin scripts |
| Custom target (advanced pattern) | — | Yes | Redact / label / pseudonym | Yes | beta | Guarded: no nested/alternating repetition, backreferences, or lookarounds; max 200 chars; must not match empty text |
| IPv6 address | — | — | Flag only | — | unsupported | |
| Names, street addresses, organizations (automatic) | — | — | Flag only | — | unsupported | Not detected automatically, except in Chinese documents where the form labels the field (法定代表人：, 地址：, 甲方：…) and the China (mainland) pack is on (beta, 2026-09-22). Add others as Custom Targets. |
International and United States are on by default. China (mainland) is available and must be turned on. A detector marked beta flags items for your decision; it is never counted as confirmed.
Document Safe-to-Send (.docx): hidden in the file
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| Author / last modified by | Yes | Remove | Yes | production | |
| Created / modified / last-printed timestamps | Yes | Remove | Yes | production | Also covers cp:lastPrinted, not just dcterms:created/modified — found missing during a 2026-09-17 real-world WPS Office file test, not covered by any earlier synthetic fixture. |
| Company / application properties | Yes | Remove | Yes | production | Cleared when present and reliably readable; not every DOCX sets this field. |
| Custom document properties | Yes | Remove | Yes | production | |
| Comments | Yes | Remove | Yes | production | Scanned/cleaned across document.xml plus every discovered header/footer/footnotes/endnotes part, not just the main document. |
| Tracked changes (insertions/deletions) | Yes | Remove | Yes | production | Accept-all semantics across document.xml plus every discovered header/footer/footnotes/endnotes part: insertions kept & unwrapped, deletions removed, deleted paragraph marks correctly merge into the following paragraph (no stray empty bullets/paragraphs). |
| Tracked formatting-only changes (rPrChange/pPrChange) | Yes | Remove | Yes | production | A formatting-only revision (e.g. re-bolded text with Track Changes on) carries no w:ins/w:del and was previously invisible to scanning; now detected and cleared as its own capability. |
| Tracked moved content (moveFrom/moveTo) | Yes | Flag only | Yes | production | Detected and flagged, but not automatically accepted — left as-is in the output, never silently dropped or claimed as accepted. |
| Tracked table row/cell insertions & deletions | Yes | Flag only | Yes | production | trPr>ins/del and tcPr>cellIns/cellDel reuse element names used elsewhere for run-level changes but mean 'whole row/cell', so they are explicitly excluded from generic accept logic (which would otherwise strip the marker while leaving the row/cell behind) and left untouched, flagged for manual review. |
| Hidden text (w:vanish) | Yes | Remove | Yes | production | Detected via reliable run-level w:vanish formatting only, across document.xml plus every discovered header/footer/footnotes/endnotes part; removes the hidden run's content. |
| Full story-part coverage | Yes | Flag only | Yes | production | True only when every revision-bearing part we can discover (document/headers/footers/footnotes/endnotes) was actually read. A glossary document, or a header/footer we couldn't resolve via relationships, marks this false and blocks an overall Verified result — see V1.1 P0 remediation: 'not fully inspected' must never be reported as safe. |
| Embedded objects | Yes | Flag only | Yes | production | Presence detected via relationship types / embeddings parts. Never auto-removed — surfaced as a manual-review warning. |
| Macros (VBA) | Yes | Flag only | Yes | production | Presence detected via vbaProject.bin. Never auto-removed — surfaced as a manual-review warning. |
| Metadata of pictures inside the document (location, time, camera, captions) | Yes | Remove | Yes | production | Every picture is recognised by its content and read with the Photo scanners (JPEG, PNG, WebP, HEIC, AVIF). Metadata is removed without re-encoding; each cleaned picture is re-scanned and checked against the original picture data. Word keeps pasted photos byte for byte, GPS included. |
| Preview picture of the first page (docProps/thumbnail) | Yes | Remove | Yes | production | Removed with its relationship; it is not updated when text is redacted, so it could still show removed text. |
| Pictures in other formats (EMF/WMF/SVG drawings, GIF, TIFF) | Yes | Flag only | — | unsupported | Listed as not fully inspected and left unchanged. |
Photo Safe-to-Share — Beta
JPEG, HEIC/HEIF, AVIF, PNG and WebP. Metadata is removed without re-encoding the picture; decoded pixels were compared on every test file. HEIC was checked on a real iPhone 17 photo (opens in Photos, location gone). Extra pictures stored in a JPEG (multi-picture / MPF, e.g. an HDR map) are checked and cleaned too. Camera settings (exposure, ISO, focal length) are shown and kept unless you remove them. Unrecognised sections are left in place and reported as not fully inspected.
JPEG
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| GPS / location | Yes | Remove | Yes | production | |
| Capture date/time | Yes | Remove | Yes | production | |
| Device / camera make & model | Yes | Remove | Yes | production | |
| Software / EXIF privacy fields | Yes | Remove | Yes | production | |
| EXIF (APP1) container | Yes | Remove | Yes | production | EXIF is rebuilt from an allow-list: a valid (1-8) orientation and the technical camera settings (exposure, ISO, aperture, focal length…; removable on request). Every other field — GPS, dates, device, serials, MakerNote, IDs, unrecognised tags, the embedded thumbnail — is dropped. With more than one EXIF container everything is removed (see jpeg.multiple-exif-containers). |
| Multiple EXIF containers (non-conformant) | Yes | Remove | Yes | production | A single JPEG should have at most one EXIF APP1 segment. When more than one is found, orientation preservation is skipped entirely and every EXIF container is removed, rather than guessing which one is authoritative. |
| Standard XMP (APP1) metadata | Yes | Remove | Yes | production | |
| Extended XMP (APP1) metadata | Yes | Remove | Yes | production | Listed separately from standard XMP per the 2026-09-17 audit (a single 'jpeg.xmp' label was too broad). Identified by its own signature and removed the same way as standard XMP. |
| IPTC / Photoshop (APP13) metadata | Yes | Remove | Yes | production | |
| JPEG comment (COM segment) | Yes | Remove | Yes | production | |
| Detailed camera/exposure EXIF fields | Yes | Remove | Yes | production | Author, copyright, comments, unique IDs, MakerNote (incl. the Live Photo link). Removed with the EXIF rewrite. |
| ICC color profile / orientation | Yes | Flag only | Yes | production | Deliberately preserved (not a privacy field) to avoid breaking color or rotation. Detect+verify only. |
| Unrecognized APPn segment | Yes | Flag only | Yes | production | Never auto-removed. Surfaced as 'not fully inspected' rather than marked safe. |
| Camera settings (exposure, ISO, aperture, focal length…) | Yes | Remove | Yes | production | Technical, shown with their values and kept by default; can be removed. The report shows 'Kept' only if the re-scan still finds them. |
| Extra pictures in the file (multi-picture / MPF: HDR gain map, depth, previews) and their own metadata | Yes | Remove | Yes | production | The MPF index is parsed and every extra picture is scanned and cleaned with the same rules as the main one; the index is rewritten for the new layout; the extra pictures' picture data must be byte-identical. An unreadable index leaves everything after the main picture unchanged and the file is reported as not fully inspected. |
| Unrecognised data after the end of the picture | Yes | Remove | Yes | production | Shown as not fully inspected and removed by default (a viewer does not need it); confirmed gone by the re-scan. |
| Original pixel/image data unchanged | — | Flag only | Yes | production | Verified by byte-for-byte comparison of every non-metadata segment (SOF/DQT/DHT/scan data) between input and output. |
HEIC / HEIF / AVIF
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| EXIF in HEIC/HEIF/AVIF (location, time, device, software, lens, Live Photo link) | Yes | Remove | Yes | production | Every Exif item is replaced in place by an empty EXIF block of the same size; no image byte moves. |
| XMP items in HEIC/HEIF/AVIF | Yes | Remove | Yes | production | Privacy XMP neutralised in place; technical XMP (HDR gain map, masks) kept; unrecognised XMP → not fully inspected. |
| Title / description / tags (udes) | Yes | Remove | Yes | production | Text blanked in place. |
| Image data unchanged | Yes | Remove | Yes | production | Every byte outside the neutralised metadata must equal the original; item layout re-checked. |
PNG
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| EXIF in PNG (eXIf) | Yes | Remove | Yes | production | Chunk removed. |
| Text chunks (author, comment, software, …) | Yes | Remove | Yes | production | tEXt/zTXt/iTXt removed; compressed text read locally. |
| XMP in PNG | Yes | Remove | Yes | production | Chunk removed. |
| Image data unchanged | Yes | Remove | Yes | production | Kept chunks byte-identical, all CRCs re-checked. |
WebP
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| EXIF in WebP | Yes | Remove | Yes | production | Chunk removed; VP8X flag cleared. |
| XMP in WebP | Yes | Remove | Yes | production | Chunk removed; VP8X flag cleared. |
| Image data unchanged | Yes | Remove | Yes | production | Image chunks byte-identical; RIFF size and flags re-checked. |
PDF Safe-to-Send — Beta
Runs in your browser with pdf-lib and pdf.js; the PDF is never uploaded. Text is removed from the page content itself — the characters are deleted and the rest of the line keeps its position — and only then covered by a box or replaced by your label. The new PDF is written from scratch (earlier versions kept inside the file are not copied), then reopened by pdf.js and searched again, including every string and stream in the file. Signatures are detected, not verified. Tested on synthetic files for every case and on PDFs written by Microsoft Word and Chrome.
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| Personal information in page text | Yes | Remove | Yes | production | Same detectors and custom targets as Document. Values are removed from the page content itself (the characters are deleted, not covered), including text in repeated blocks, hidden or white text and invisible OCR layers; then the new file is reopened by an independent reader and searched again. |
| Document information and XMP metadata | Yes | Remove | Yes | production | Author, title, subject, keywords, app, producer, dates, custom properties, the XMP packet, metadata on pages/pictures and app-private data. |
| Comments, notes, highlights and drawings | Yes | Remove | Yes | production | |
| Text in pages that are pictures (scans, photos of paper), read by text recognition (OCR) | Yes | Remove | Yes | beta | Runs on your device (Tesseract, Simplified Chinese and English), up to 60 pages per file. It can miss or misread words, so such pages are never counted as fully checked. Removing blacks the text out in a new picture of the page; the old picture is not kept, and the new copy is read again to confirm. |
| Photo details inside pictures (EXIF, XMP, IPTC, comments) | Yes | Remove | Yes | production | JPEG pictures are read and cleaned by the photo engine: location, time, device, author and editing history removed, picture data byte for byte. JPEG 2000 pictures, JPEGs behind another filter and inline JPEGs with details are reported as not read or not removable, never as checked. |
| Attached files | Yes | Remove | Yes | production | Listed with name, size and type. Small text attachments are searched for personal information; other attachment contents are not opened, so a kept attachment is never counted as checked. |
| Filled-in form values (AcroForm, XFA data) | Yes | Remove | Yes | production | Kept by default (they are the content of a filled form). Personal information inside a value is handled like any other text. |
| Editable form fields (flatten) | Yes | Remove | Yes | beta | Flattening makes fields part of the page; the values stay visible. It is not a privacy removal. |
| JavaScript, launch, submit and other automatic actions | Yes | Remove | Yes | production | Never executed — only classified. |
| Links to websites | Yes | Remove | Yes | production | Kept by default. |
| Digital signatures | Yes | Remove | Yes | production | Detected, not cryptographically verified. Any new copy invalidates a signature; the user must confirm before a copy is made. |
| Earlier versions kept by incremental saves | Yes | Remove | Yes | production | The new file is always written from scratch. |
| Encrypted and password-protected PDFs | Yes | Flag only | — | unsupported | Encrypted PDFs that open without a password are checked but not cleaned in this version; password-protected PDFs can't be opened. |
| Scanned pages and text inside pictures | Yes | Flag only | — | unsupported | Detected and reported as not fully checked. No OCR in this version: 'no text found' is never reported as 'nothing found'. |
| Redaction marks that were never applied | Yes | Flag only | Yes | beta |
Video Safe-to-Send — Beta
Reads the file's metadata boxes only; the video is never decoded, re-encoded or uploaded, and only the small metadata parts of the file are read, so a large video is never loaded into memory in one piece. What you choose to remove is overwritten in place with empty space of exactly the same size, so every other byte — all the picture and sound data — stays where it was. The new copy is then read back from its own bytes, searched again for what you removed, and compared with the original byte by byte outside those metadata boxes. The picture and the sound are never inspected: faces, number plates, screens and spoken words are listed as not checked, never as clean. Tested on synthetic MP4 and MOV files covering the four metadata shapes real writers produce, with the cleaned copies decoded by ffmpeg to confirm every frame is unchanged.
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| Recording location (©xyz, loci, com.apple.quicktime.location.*) | Yes | Remove | Yes | beta | The whole metadata box is replaced by empty space of the same size; no frame byte moves. |
| Recording date and time (mvhd/tkhd/mdhd, ©day, creationdate) | Yes | Remove | Yes | beta | Header time fields are zeroed in place; date metadata boxes are emptied. |
| Device maker, model and software | Yes | Remove | Yes | beta | Metadata boxes emptied in place. |
| Title, author, description, comments, keywords | Yes | Remove | Yes | beta | Metadata boxes emptied in place. |
| XMP packets in a uuid or udta box | Yes | Remove | Yes | beta | Packet box emptied in place; classified as privacy or technical before removal. |
| Metadata fields we don't recognise | Yes | Remove | Yes | beta | Emptied by default; never reported as harmless. |
| Picture and sound unchanged | Yes | Remove | Yes | beta | Every byte outside the emptied metadata must equal the original, and the top-level layout is re-checked. |
Text and CSV
| What | Detect | Change | Re-checked in output | Status | How / limits |
|---|---|---|---|---|---|
| Personal data in plain text / CSV | Yes | Remove | Yes | production | Same detectors and custom targets as Document. Removed values are searched for again in the new file. |
| Invisible characters (zero-width, direction controls) | Yes | Remove | Yes | production | Removed by default; you can choose Keep. |
| Rows, columns and lines unchanged | Yes | Flag only | Yes | production | CSV row and column counts and the line count must match the original. |
UTF-8 and UTF-16 files are written back in the same encoding. Files without an encoding marker that aren't UTF-8 are read with a best guess (GB18030 or Windows-1252), marked not fully inspected, and saved as UTF-8.
Known limitations
- Names, street addresses and organizations are not recognized automatically, except in Chinese documents where the form labels the field (法定代表人：, 地址：, 甲方：…) and the China (mainland) pack is on. Add others as your own terms.
- Text recognition (OCR) is used only for PDF pages that are pictures: Simplified Chinese and English, on your device, up to 60 pages per file, and it can miss or misread words. Text inside photos, screenshots and pictures in Word documents is not read.
- Excel, PowerPoint, older Office files (.doc/.xls/.ppt), OpenDocument, RTF and camera RAW/DNG are not checked yet. GIF, TIFF and BMP pictures are not supported.
- PDF: pages that are pictures are read by text recognition; removing something from them turns the page into a new picture with the text blacked out (typed text on that page can no longer be selected). Because recognition can miss words, such PDFs are reported as "Could not fully verify". Encrypted PDFs are checked but not cleaned; password-protected PDFs can't be opened. Text in fonts without a usable character map, vertical text and text in unusual encodings is reported, not rewritten. Contents of attached files other than small text files are not opened. Photo details stored inside JPEG pictures (location, time, device, author) are found and removed; JPEG 2000 pictures and photos stored behind another compression layer are reported as not read.
- Video, metadata tool: MP4 and MOV up to 500 MB, metadata only — the picture and sound are not inspected and not changed.
- Video, picture tools (faces, licence plates, on-screen text): up to 300 MB, one at a time. Detection misses things — small, turned-away or motion-blurred faces, plates outside China (the model was trained on Chinese plates), highlighted or light-on-dark text — and in a dark video it falls apart, which the page says when it happens. Only the frames it samples are looked at, at most 0.4 s apart. Marking an area by hand always works. The new copy is re-encoded and the covers are burned in; the sound is copied unchanged and nothing in it is inspected.
- Pictures inside a Word document in EMF, WMF, SVG, GIF or TIFF format are listed as not fully inspected and left unchanged.
- HEIC/AVIF image sequences (moving pictures) and uncommon HEIF structures are reported as not fully inspected.
- Photo cleaning removes all detected photo metadata together; you can't keep only some of it in the Photo tool (you can in Check Any File for HEIC, PNG and WebP).
- Phone numbers: US/NANP formats, international numbers written with a leading + (beta), and China mobile numbers (opt-in). Other national formats are not detected.
- IPv6 addresses are not detected.
- API keys: only providers with a fixed, documented format are detected. Generic "password = …" lines are beta and always need your decision.
- DOCX custom XML data, building blocks/glossary, charts and SmartArt are searched but not rewritten. Matches there are reported for you to handle.
- Contents of embedded objects (e.g. an embedded spreadsheet) and macros are flagged, not opened or removed.
- Tracked moves and table row/cell revisions are flagged, not accepted automatically.
- Redacting text that is also shown by an updatable field (e.g. DOCVARIABLE) changes the cached display text; updating fields later may recompute it.
- Real phone/camera photo coverage is still being validated on a wider set of devices (so far: one iPhone 17 HEIC photo and five iPhone JPEG photos).
- This is not a legal, medical or regulatory compliance tool, and no tool can promise a file is completely safe.
Open-source software
PDF files are read with Mozilla pdf.js (Apache-2.0) and pdf-lib (MIT), running in your browser. Every third-party package in this site, with its license text: third-party-licenses.txt.