Redactic for real estate

GDPR for estate and letting agents: your team writes to AI with real tenant and buyer names, and the model receives only placeholders.

Redactic replaces names, phone numbers, IBANs, tax codes and the other identifiers it detects with placeholders before the model receives your message, then puts the real values back in your browser. It reads photographed IDs and scans, recognises national identifiers and bank details by their check characters, and redacts whole spreadsheet columns while the amounts stay readable, with detection and masking in Europe and no files kept.

Tenant application files, ID cards, payslips, tax notices, bank details, leases, sale files, owners' meeting minutes and tenant spreadsheets, in PDF, Word, Excel or as photos.

Personal data masked before the AI Detection and masking in Europe Files and conversations not stored GDPR art. 28 DPA signed when you subscribe
The problem

Tenant files and AI meet in your agency every day.

01Your agents would like an AI to draft replies to tenants and owners or to summarise a lease, but every message carries names, phone numbers and IBANs, and some of them already paste those details into chat tools the agency does not control.
02Applicants send photos of their ID, payslips and tax notices by e-mail and messaging apps, and those files then travel between colleagues, owners and partners in full.
03The owner needs to know that the income is there, not the applicant's tax code, account number or employer's address.
04The tenant spreadsheet has to go to the property manager or the accountant, yet every row holds a name, a phone number and an IBAN.
Secure Chatbot

Firm: your whole agency uses AI with real names, and the model receives placeholders.

With Firm, every agent and property manager writes to the Secure Chatbot with the real names, phone numbers and IBANs of tenants, buyers and owners, asks for a reply, a reminder or a summary, and Redactic masks the personal data in every message before the model receives it. The answer comes back masked and each person's browser puts the real values back in. If masking is not available, the message is not sent.

The chat keeps no conversation on our servers, masking runs in Europe on infrastructure Redactic controls, and the people who manage your workspace decide who uses the chat and how much AI each agent can use. Document redaction for up to 50 users is part of the same plan.

  • Open to everyone in the workspace by default, or only to the people you choose.
  • A fast model or a reasoning model, chosen in the chat.
  • The countries of the conversation set the phone and ID formats Redactic recognises, and they stay for the whole chat.
  • Protection against prompt injection is active, and every turn counts against the AI quota of the person who sent it.

Running a network or a group with several branches? Enterprise adds unlimited users, volumes and AI quotas tailored to each team, a DPA built around your policies, and dedicated, single-tenant, private-cloud or on-premise deployment.

Working on your own? With Solo you have the same protection in the document chat: the file reaches the AI already masked, and the names you type in your questions are masked before they are sent.

In practice

Real estate document redaction that reads a tenant application the way you do.

Below is a fictitious summary of a tenant application, as an agency would send it to the owner. Redactic finds the personal data, recognises the Italian tax codes and the IBAN by their check characters, and leaves the income, the rent and the substance of the application untouched.

What Redactic finds in this application

Field in the documentType of dataHow Redactic handles itCheck character verified
Paolo Ferri, Sara LombardiPerson namesRecognised; with the name list, certain in every form, surname alone includedNot applicable
FRRPLA71C12H501C, LMBSRA88D45F205MTax code (codice fiscale)RecognisedYes
IT60X0542811101000000123456IBANRecognisedYes
Via Padova 112, 20132 Milano (MI)Postal addressRecognisedNot applicable
[email protected]E-mail addressRecognisedNot applicable
+39 347 218 5530Phone numberRecognisedNot applicable
LOC-2231File referenceMasked with one click, or added to your listNot applicable
EUR 2,850.00 and EUR 1,150.00Income and rentKeptNot applicable

Fictitious data. The income, the rent and the structure of the application stay as they are, so the owner can decide without seeing the applicant's identifiers.

Workflow

From tenant file to shareable copy, or to an answer from the AI.

1

Upload the file, the photo or the spreadsheet

Add a PDF, Word or Excel file, a photo of an ID taken with a phone, a scan, or paste the text. For a spreadsheet, Redactic proposes the type of each column from its header and you confirm which columns to mask, so a whole column of names or IBANs is covered row by row.

2

Review what Redactic found

Each element is listed with its type. Redact all, keep all, or decide item by item, so the owner receives the income and the rent while the account number, the tax code and the transactions you do not need disappear from the bank statement or the payslip. Click any word in the text to mask it as well.

3

Download, or work with AI

Download the PDF with Blackout and the redaction certificate, or the spreadsheet with the sensitive columns masked and its structure and amounts intact. Or open the document chat and ask your questions with the names as they appear in the file: Redactic masks them before sending, and the answer comes back with the real names on your device.

Choose your plan →

Security

Built for the personal data that passes through an agency.

01

The AI receives placeholders, not your clients' names.

In the Secure Chatbot and in the document chat, Redactic masks the personal data it detects before the model receives the text, and the answer is restored in your browser. If masking is not available, nothing is sent.

02

Photos and scans of IDs, read and redacted.

ID cards, payslips and tax notices photographed with a phone or scanned are read with OCR first, and the text under every black box is deleted from the exported PDF, so it cannot be selected, copied or recovered.

03

Identifiers and bank details checked, not guessed.

National identifiers such as tax codes, personal ID numbers and French RIBs, and IBANs in every country format, are recognised by their check characters where the format has one, so a valid number is found even when it appears without a label.

04

Spreadsheets by column, amounts intact.

In an Excel or CSV file, Redactic proposes the type of each column from its header, you confirm, and every cell of the columns you choose is masked while the rents, the deposits and the structure of the sheet stay as they are.

05

Photo locations and document properties removed.

Photos lose their EXIF and GPS data, redacted Word files lose comments, tracked changes and author details, and PDFs lose author and XMP metadata.

06

Europe, temporary processing and a DPA.

Detection and redaction run in Europe on infrastructure Redactic controls, without third-party AI reading the unredacted text. Your files are not saved, and the data processing agreement under GDPR art. 28 is signed when you subscribe.

Professional duties

The rules on tenant and client data, and the facts that serve them.

These are the rules your work answers to. Next to each one is what Redactic actually does, so you can judge for yourself how it fits your agency.

EU anti-money-laundering rules, Directive (EU) 2015/849, art. 2(1)(3)(d).

Estate agents are obliged entities under the EU anti-money-laundering rules, letting agents included where the monthly rent is EUR 10,000 or more, so the customer file you build for due diligence stays complete and in your hands. Redactic leaves that file as it is: the copies you share outside the agency and the text the AI receives carry only the data you choose to keep.

GDPR art. 28, processor.

Your agency decides why and how client documents are processed; Redactic acts as your processor under a data processing agreement signed when you subscribe.

GDPR art. 32(1)(a) and art. 4(5), pseudonymisation as a security measure.

Article 32 names pseudonymisation among the measures for the security of processing. Redactic pseudonymises personal data before any AI step, runs detection in Europe and keeps neither your files nor your conversations.

GDPR art. 5(1)(c) and art. 25, data minimisation by design.

Only the data a purpose needs should be processed. The owner who chooses a tenant needs proof of income, not account numbers or tax codes: the copies you share carry only the data you chose to keep, and the AI receives the masked text.

Redactic describes what its tools do; the assessment of your own processing remains yours, with the support of the DPA and the Trust & Security page. Security

FAQ

Frequently asked questions.

Can our agents write to the AI with the real names of tenants and buyers?+

Yes. With Firm, the Secure Chatbot masks the names, phone numbers, IBANs and other personal data it detects in every message before the model receives it, and each agent's browser puts the real values back in the answer. On every plan, the document chat masks the file before the AI sees it and masks the names you type in your questions too.

Can a landlord ask for bank statements?+

That depends on the rules of your country and on the stage of the application. Where a bank statement or a payslip is requested to prove income, Redactic lets you send a copy that keeps the income and blacks out the account number, the transactions and the identifiers the owner does not need.

Are conversations with the AI kept anywhere?+

Not on Redactic's servers. The Secure Chatbot keeps no conversation history, the conversation lives in your browser, and the map of placeholders is not retained between messages. The AI provider of the workflow you use receives only the masked text, under the terms set out in the DPA.

Does it work on a photo of an ID card taken with a phone?+

Yes. Photos and scans are read with OCR, so the name, the document number and the address printed on the card are found as in any other file, and the photo loses its EXIF and GPS data.

Can I remove the IBAN and the tax code and keep the income?+

Yes. You review every element Redactic finds and keep what the owner needs, so the income, the rent and the dates you choose stay readable in the copy you send.

Can I redact a whole spreadsheet of tenants?+

Yes, by column. Redactic proposes the type of each column from its header, you confirm, and every cell of the chosen columns is masked while the structure of the file and the amounts stay as they are.

How many people in the agency can use it?+

Up to 50 users with Firm, each with an AI quota you can set, and unlimited users with Enterprise, with volumes and quotas tailored to your teams.

Where are documents processed, and do you keep them?+

Detection and redaction run in Europe on infrastructure Redactic controls, without third-party AI reading the unredacted text. Your files are not saved.

Who is the data controller, and can Redactic run in our own environment?+

Your agency is the controller for its documents, and Redactic is the processor under GDPR art. 28, with a DPA signed when you subscribe. For groups and networks, Enterprise offers a DPA built around your policies and dedicated, single-tenant, private-cloud or on-premise deployment. Data Processing Agreement Security

Guides

Guides for agencies and property managers.

Data Redaction

Data Redaction Guide 2026: Mask PII for GDPR and AI

Read article →
Data Redaction

Shadow AI Statistics 2026: Where Each Number Comes From

Read article →
Start now

Bring AI into the agency, and keep your tenants' and clients' data away from the model.

Detection and masking in Europe, no files or conversations stored, and a DPA signed when you subscribe.

For groups and networks of agencies, Enterprise offers unlimited users and dedicated, single-tenant, private-cloud or on-premise deployment.

Choose your plan →