Datenmaske Secure · Manual
From download to redaction — the whole product, explained.
Every step and every setting of Datenmaske Secure, in one place. Nothing leaves your machine at any point — installation, detection and export all run locally.
Download & installation
Requirements
Windows 10 or 11. No cloud account, no server — the app runs entirely on your workstation.
Installer
You receive the download link with your Early-Access confirmation. Run the MSI installer; it sets up the app plus the Windows integration.
First start
On first launch the signed recognition models are downloaded once and verified (Ed25519, SHA-256 per model). After that everything works offline.
Activating your license
The 7-day test license
Your confirmation email contains the license key. In the app: “Lizenzschlüssel eingeben” → paste the key. The key is verified locally — no network, no account needed.
After the test week
The license simply expires; documents already exported stay redacted. Early-Access users get the full license — request it via the waitlist.
The workflow
Scan
Drag any PDF into the window (or right-click in Explorer → “Schwärzen mit Datenmaske”). Three detection engines run locally: regex (IBAN, e-mail, phone), NER (names, addresses), gazetteer (doctors, firms).
Review
Every suggestion, one decision: accept or reject. Missed spots you mark yourself — the rectangle you draw is redacted like any finding.
Export
MuPDF physically removes the confirmed content, the result is re-opened and verified: the tiniest gap locks the export (fail-closed). The Schwärzungsprotokoll documents everything.
Settings — every card explained
Allgemein · General
Language (German, English, French) and theme: light, dark or system.
Erkennung · Detection
Active types: choose which of the 12+ PII types are scanned (name, address, IBAN, e-mail, phone, insurance number, tax id, …). Redaction profile: strict vs. balanced suggestion density. Custom: your own regular expressions and a private gazetteer (up to 2,000 entries, CSV or one-per-line).
Aktenvorlagen · Case templates
Save per-case type selections — e.g. a medical file scans different types than a tenancy file. Select the template when scanning.
OCR-Engine
Two local engines: Paddle (default, strong on German print) and ocrs (faster, leaner). Only relevant for scanned pages; digital PDFs never need OCR.
Lokale Engine · Local engine
The recognition models, their size and variant — including the update state. All models load signature-verified.
Lokaler Assistent · Local assistant
An optional local LLM that helps phrase anonymizations. Runs on your machine; off by default.
PDF/A · Ghostscript
Export redacted documents as archival PDF/A using the bundled Ghostscript — required by many courts and archives.
Ordnerüberwachung · Hot folder
Watch a folder: every PDF dropped there is scanned, redacted and saved automatically — fail-closed, encrypted queue. Ideal for high-volume mailrooms.
Windows Explorer Integration
Right-click any PDF → “Schwärzen mit Datenmaske” opens the app with the document loaded.
Lokale API
A localhost API for scripted workflows (document management systems, automation). Binds to your machine only.
TOM-Dokumentation
Generates the technical-and-organisational-measures record (Art. 32 GDPR) for your compliance file — what the tool does, where data flows.
Experimentelle Funktionen
Early features we ship flagged, not hidden. Anything unstable stays off unless you switch it on.
Updates
Automatic update check against our signed release channel; you choose when to install.
Security & § 203
Local by construction
PDF pages, OCR text, findings and redactions never leave the device. The only network touches: license check (monthly, optional) and signed model downloads.
Fail-closed export
An incomplete verification is not a warning — it blocks the export.