Security
European infrastructure
For standard SaaS, your documents are uploaded to Redactic and detection and redaction run on Redactic-controlled infrastructure in Europe. Unredacted content is not sent to third-party AI/ML inference services for these operations. Optional AI workflows have separate provider terms.
Automated detection may include machine learning; optional generative AI workflows are separate.
Separate AI workflows
Optional AI features use the selected third-party provider. Processing region, retention and training terms depend on the workflow and applicable agreement. Masked text may still contain personal data through context or missed identifiers.
Provider availability, processing region, retention and training terms depend on the selected AI workflow and applicable agreement. Consult the Redactic DPA and discuss requirements with us.
Blackout
Permanent redaction removes selected sensitive information from the exported document. Reversible masking replaces detected values with placeholders and uses a mapping for restoration in supported workflows. Neither automatically establishes GDPR anonymisation; review the output and remaining context.
Automated detection helps identify sensitive information. You decide what gets redacted; detection can miss values and depends on language, document quality and context.
Local restoration
Reversible masking uses a mapping to restore detected values in supported workflows. Temporary server-side processing can be involved; protect mapping files as sensitive information.
Temporary processing
Documents and results use temporary processing storage. Account, billing and operation records have separate retention terms; consult the applicable DPA and privacy notice.
Data processor role
For customer document processing, we act as processor under the Redactic DPA. Customers determine the lawful basis and purpose. Account and billing processing are described in the privacy notice.
Enterprise deployments built around your infrastructure.
For strict security, data-boundary or regulatory requirements, we design custom Enterprise deployments. Options can include dedicated infrastructure, single-tenant environments, private cloud and fully on-premise installations, subject to technical and commercial assessment.
On-premise and customer-controlled deployments are custom Enterprise projects. Architecture, integrations, operational responsibilities and support are agreed individually. Optional AI availability and any offline requirements must be assessed separately.
Assurance and certifications
Request current Redactic-specific assurance documentation for procurement review. A hosting provider's certification does not certify Redactic, and a certification roadmap is not an obtained certificate. This page makes no claim that Redactic holds ISO 27001 certification.