Redact a file before it leaves
Upload a PDF, Office or spreadsheet file, see what sensitive content it holds, and download a redacted copy that has been re-scanned.
- Version: 0.4
- Role: admin_user
- Type: task
File Redaction takes one file, runs it through the same detection pipeline that guards chat, and gives you back a redacted copy. Use it to clear a document for sharing, or to find out what is in one before anybody sends it anywhere.
What do I need?
- Licence
- Any
- Role
admin_user
Prerequisites
- The document-parser and redactor services are running; the page needs both to produce a copy.
- The file is 20 MB or smaller and in one of the accepted formats: PDF, DOCX, TXT, CSV, TSV, XLSX.
- You are not signed in as a viewer — a read-only account can open the page but not run an analysis.
Note
This page is a one-file tool, not a settings screen. What the pipeline detects and which action it takes is decided by the rules on Security filters; there is nothing to configure here.
/assets/screenshots/file-redaction@0.4.pngAnalyse and redact a file
Open the page
Select Detection & Filtering → File Redaction.
The Upload a file tile shows a drop zone captioned PDF, DOCX, TXT, CSV, TSV, XLSX · up to 20 MB, and Result shows No file analyzed yet.
Choose the file
Drop a file on the zone, or select it to browse.
The file appears as a chip with its type and size. An unaccepted file is refused in the browser before any upload, under the heading Unsupported file.
Decide what you want back
Leave Produce a redacted copy (uncheck to only detect) ticked to get a downloadable file, or clear it to run detection only.
The primary button changes between Analyze & redact and Analyze to match.
Choose the depth of the scan
Leave Skip safety screening (faster) — masks PII only clear for the full scan, or tick it to run PII detection alone.
Skipping safety screening drops toxicity and attack checks; the file is still scanned for personal data and secrets.
Start the job
Select Analyze & redact.
The job runs in the background. A progress block shows the stage and percentage, and states Runs in the background — you can leave this page and we'll notify you. A large file adds Large file — this can take several minutes.
Read the verdict
Wait for the Result tile to fill in.
The verdict tag is one of No sensitive content, Redacted, Flagged or Blocked (fail-closed), beside the file name, page count and processing time. Three tiles summarise Detections, Verdict and Redacted copy.
Download the copy
Select Download redacted file.
The file downloads with the name the gateway supplies, falling back to redacted- plus the
original name.
What the result tells you
The Detections table groups findings by entity type, with a count and one Sample (masked)
per type — the sample is always obscured, so the raw value is never rendered on this page. For a
spreadsheet or CSV, a Redacted content preview shows the sheet with placeholder cells such as
[EMAIL] in place of the values that were removed.
| Verdict | Meaning |
|---|---|
| No sensitive content | Nothing matched. No copy is produced |
| Redacted | Matches were masked and a copy was produced |
| Flagged | Matches were recorded and the file was left as it is |
| Blocked (fail-closed) | The file was not released — either the sensitive content sits somewhere that cannot be safely redacted, or verification found residual content |
The Redacted copy tile also reports verification. Verified clean means the redacted copy was re-scanned and produced zero residual detections; the footer states it as Verified clean — redacted copy re-scanned, 0 residual detections. Not verified carries an explicit warning: The redacted copy could not be verified clean. Review it carefully before sharing.
Warning
Legacy and macro-enabled spreadsheets are refused outright — .xls, .xlt, .xlsm, .xltm and
.xlsb. Macros can reconstruct redacted data, so redaction cannot be verified for them. Save the
workbook as .xlsx and retry.
Fields reference
| Control | Effect |
|---|---|
| Drop zone | Accepts one file at a time, .pdf, .docx, .txt, .csv, .tsv, .xlsx, up to 20 MB. The limit is enforced by the gateway as well as the browser |
| Produce a redacted copy (uncheck to only detect) | On: a redacted file is generated and offered for download. Off: detection only, no copy |
| Skip safety screening (faster) — masks PII only | On: PII and secrets only. Off: the full pipeline, including toxicity and attack checks |
| Analyze & redact / Analyze | Submits the job. Disabled with no file, while a job runs, and for a viewer |
| Download redacted file | Fetches the stored redacted copy for this analysis |
Verify
- The Result tile shows a verdict tag and a Detections count that matches what you expect for the file.
- Open All detections and set Source to Document analysis. The run appears there, because document analyses are one of the feed's five streams. A run whose verdict was No sensitive content is not listed — allowed rows are excluded from the feed.
- The downloaded copy opens, and the values you expected to be removed are placeholders.
Note
This page writes no row to Event logs. The analysis is stored in the document-analysis table that feeds All Detections, and nothing else records it, so do not look for it under an event type.
If it fails
- Unsupported file type ".
{ext}". Supported: PDF, DOCX, TXT, CSV, TSV, XLSX. — the extension is not accepted. Extension, not MIME type, is what is checked: browsers report unreliable types for.csvand.xlsx. - Legacy/macro-enabled Excel formats can't be safely redacted — save as .xlsx and retry. — see the warning above.
- File too large:
{n}MB. Maximum is 20MB. — split the document or extract the pages you need. - Redaction failed in the Result tile — the job ended in error; the message beneath names what the pipeline reported. A parser or redactor service that is down fails every file, not just yours.
- File not released — a Blocked (fail-closed) verdict. This is the pipeline refusing to hand over a file it cannot prove is clean, not a bug. Redact the source document by hand, or remove the offending element.
- Could not download the redacted file. — the copy is stored against the analysis id; a failure here is a gateway problem, not a redaction problem. Re-run the analysis.
- Read-only demo account — analysis is disabled. — the viewer role may open the page but not run work.
Next steps
- All detections — see this run alongside every other capture point.
- Security filters — change which entity types are masked, flagged or rejected in files as well as prompts.
- Browser-traffic inspection — redact uploads automatically as they leave, instead of file by file.
Last updated on