Security you can point at, not just take on faith

Permanence and the verification pass

Redaction in RedactBot is destructive by design. When you burn in your reviewed marks, the underlying content — text and pixels — is removed from the document, not covered with a shape that could be lifted later. After burn-in, an automated verification pass re-examines every affected page to confirm the removed content is no longer present in the output file. The released document contains no recoverable trace of what you redacted.

Audit trail and certificates

Every consequential action — uploads, scans, review decisions, burn-ins, exports, deletions — is recorded in a hash-chained audit trail: each entry incorporates a cryptographic hash of the one before it, so any alteration of the history is detectable. Privilege logs and redaction certificates are generated from this record. Certificates describe a user-reviewed process: they attest to the marks you reviewed and applied and the verification pass that followed, not to an unattended machine judgment.

Where your data lives

• Database and document storage: Supabase, hosted on AWS in the us-west-1 region.
• Application and compute: Cloudflare’s network serves the app and runs processing.
• Payments: Stripe. Card details go directly to Stripe; we never see or store card numbers.
• Account email: Resend delivers sign-in, password reset, and security notices. It receives only your email address and the message content.

Your documents live in your account and nowhere else. Free and Pro plans auto-delete documents on a fixed schedule (48 hours and 14 days respectively); Premier keeps documents until you delete them. Deleting a document, or closing your account, removes the stored files.

AI egress — off by default

AI detection is off by default. When you turn it on, detection on Pro and Premier runs through one managed AI gateway operated for RedactBot; your document text is sent only to return detections and is never used to train models. The gateway and the model provider behind it are disclosed as subprocessors in the Privacy Policy. Enterprise customers can instead connect their own OpenAI-compatible endpoint; text then goes only to that endpoint, under their keys and their terms. If you never run AI detection, your document text never leaves the processing pipeline described above.

Encryption

All traffic between your browser and RedactBot, and between RedactBot and its subprocessors, is encrypted in transit with TLS. Documents and database contents are encrypted at rest by the underlying platforms (Supabase/AWS).

Account isolation

Each account sees only its own workspaces, documents, templates, and audit records. Authorization is enforced on every request at the API layer — there is no cross-account visibility of any kind.

Responsible disclosure

If you believe you have found a security vulnerability in RedactBot, please email security@redactbot.app. We ask that you give us a reasonable window to investigate and remediate before public disclosure, and we commit to acknowledging reports promptly.

RedactBot is designed to support customers’ compliance programs and regulated workflows. Premier and Enterprise customers can execute a Data Processing Agreement.