An online redaction or anonymization tool asks you to upload the file you are trying to protect. That may be fine for some documents and wrong for others. Here is what happens to the file, what to ask, and how a local tool differs.
What happens when you upload a file
- The file travels over the internet to the vendor's servers.
- A server processes it. Often it passes through further services: storage, queues, a processing provider, a logging system.
- The result comes back to you. Whether the original and the result are deleted afterwards, and when, is set by the vendor's policy.
- Copies may remain in backups, logs, error reports and support tools for a period.
None of this is unusual or sinister. It is how web services work. But it means that before the file is protected, it has been sent, in full and with every name in it, to a company you may know little about.
Two hops instead of one
If the goal is to ask an AI tool about the document, an online anonymizer adds a hop. Your file goes to the anonymizer first, and then the cleaned text goes to the AI. If you would not paste the original into the AI, ask yourself why it is acceptable to upload it to a third party that only promises to clean it. The anonymizer may have excellent terms. It still received the original.
Questions to ask any online vendor
- Where is the file processed and stored, and in which country?
- How long is it kept, including backups and logs, and can you delete it yourself?
- Who can access it: staff, contractors, sub-processors? Is the list published?
- Is it used to train or improve any model, theirs or a partner's?
- Is there a data processing agreement you can sign, if your rules need one?
- What happens in a breach, and how fast would you be told?
- What do the logs contain? File names, text, IP addresses?
- What does the account hold? A history of every file you uploaded is a record in its own right.
If the answers are vague or missing, that is the answer.
What "local" means, and how to test it
A local tool does the work on your own computer. The file is read from your disk and the result stays on it. The simplest test is practical: disconnect from the internet and use the tool. If it works, the processing is on your machine. If it stops, something is being sent.
Look at what the vendor says about network use too. ClientSafe, for example, makes no network requests except for Microsoft Store licensing, and has no telemetry. Ask any vendor for an equally plain statement.
Local does not mean careless. Check what the tool stores on your disk, how it protects it, and how you delete it. In ClientSafe the table that links placeholders to real names is stored encrypted on your PC until you delete the case.
Side by side
| Question | Online tool | Local tool |
|---|---|---|
| Does the original leave your computer? | Yes, in full | No |
| Who else may handle it? | The vendor and its providers | Nobody else |
| What do you rely on? | Their policy and their word | What you can check on your own machine |
| Does it work offline? | No | It should |
| Do you still need to review the result? | Yes | Yes |
When online is fine
Online tools are a reasonable choice for documents that carry little risk: a public report, your own draft, a template. They are also easier to set up. The question is not whether online tools are bad. It is whether this particular file should leave your machine.
Free upload tools
A free tool that asks you to upload a client file deserves extra attention. Ask how it pays for itself. If the answer is not clear and the policy is a paragraph long, treat the upload as sending the file to a stranger. A paid or free tool with a clear policy, a stated retention period and a way to delete your files is a different matter. Whatever you pick, keep a note of why you picked it, in case a client asks.
Redaction and safe copies are different jobs
Redaction produces a document you can hand to someone else, such as a court or a counterparty, with the sensitive parts removed for good. A safe copy for AI is a text version where identities are replaced by placeholders, for your own use. Tools are built for one or the other. ClientSafe makes safe copies for AI tools. It is not for redacting documents you send to another party or a court. See placeholders versus black bars.
Frequently asked questions
If a vendor says files are deleted immediately, is that enough?
It is a good sign. Ask also about backups, logs and sub-processors, and keep the answer in writing.
Is a desktop app always local?
No. Some desktop apps send files to a server to be processed. Test with the network off.
Does a local tool still need review?
Yes. Detection is not perfect in any tool. A local tool means the file does not leave your PC. It does not mean everything was found.
ClientSafe runs on your PC and shows you what it found so you can correct it before you copy. The original file is not changed, and the safe copy is what goes to the AI tool.