Black box ≠
removed data
Most redaction tools place a bar over the text. Visually unreadable — the content still sits in the PDF content stream and can be recovered in seconds. Datenmaske removes the text for real and verifies it fail-closed.
KI-generiert
THE PROBLEM
A recoverable “redaction” is a data breach waiting to happen.
An Essex software audit (n=72 publicly indexed PDFs) found in about 17 % — every 6th file — residual extractable sensitive data in apparently redacted documents. Sample, not representative , but the mechanism is technically undisputed.
For a law firm, public authority or HR department this means: a released PDF whose content can be recovered is a DSGVO- and §-203-StGB-relevant breach — regardless of how the box looks visually.
HOW DATENMASKE REDACTS
Content stream removal, verified fail-closed
Detect
Regex + spaCy/GLiNER-NER + gazetteer + optional OCR delivers a bounding box + detected text per match.
Remove
MuPDF applyRedactions() removes the text operators and glyph references from the content stream — no overlay. Metadata additionally removed via pdf-lib.
Verify (fail-closed)
verifyRedactions reopens the exported PDF and checks that no detected PII string remains. On failure the export is blocked.
COMPARISON
What happens to the PII text?
HONEST LIMITS
What we don't promise.
- OCR pages are text-layer-verified, not pixel-verified. If PII appears as an image on an OCR page, we confirm the text removal but cannot guarantee the image pixels. We honestly flag these pages as
verified: falsewith reasonocr_page_not_pixel_verified. - “100 % irreversible” refers to the removed text content — a self-capability that the verification step tests. No guarantee that every conceivable PII was detected (therefore human-in-the-loop remains the default).
- No “§ 203-certified”. There is no such certificate. Datenmaske is a tool in the compliance stack.