ON-DEVICE DOCUMENT REDACTION

Redaction,
with a receipt.

Lay a sensitive document on the table. It detects, you review, together you catch everything — then it seals itself and signs a receipt proving not one byte left your device.

No “finds every name” promises. A detector finds the standard PII; a human catches the rest; the receipt proves exactly what was sealed.

AIRGAP LIVE watching every connection this tab makes

0 bytes off this device

0 off-origin requests · 0 on-device reads

⌥ Open your browser’s Network panel and watch. Through the whole redaction, it stays at zero.

THE EXAMINATION TABLE

Lay a document on the table

Drag it here, or . It is read in this browser tab — it never leaves your device.

.txt.md.csv.json.html .pdf .docx — soon

Multilingual name detection RECOMMENDED On-device · ~135 MB one-time download, cached · finds names in non-Latin scripts (Cyrillic, CJK, Arabic, Devanagari, Greek, Hebrew, Thai and more) by context. Nothing is sent — the model runs in this tab. The built-in Latin detector always stays on. On by default. It loads the first time you redact a document.

THE SELF-REFUTING PITCH

Every other redaction tool asks you to upload the sensitive file first.

To remove the secret parts, they first take a copy of the whole thing onto their servers. You have to trust a policy. cloak-redact never receives the file at all — extraction, detection, redaction and signing all happen in this browser tab. There is nothing to trust, because there is nothing to send.

Everyone else your file → their server → redacted copy

cloak-redact your file → stays here → redacted copy

CHAIN OF CUSTODY

Four moves, all on your side of the airgap.

Detect

A WASM engine reads the text and finds names, emails, phones, cards and IDs — in the tab, with no model call.

Review

You see every candidate and decide. Reveal a false positive, or select any missed text to redact it yourself. Live secrets stay locked.

Seal

Redactions stamp into place. Real values become safe stand-ins so the document still reads; secrets and your catches become opaque marks.

Prove

A device key signs a chain-of-custody receipt — counts, categories, hashes, and “0 raw PII egress”. It verifies offline, forever.

THE MOAT, MADE VISIBLE

Feel the silence.

The meter isn’t decoration — it installs a real instrument that watches every connection this tab makes and counts the bytes sent off-device. During redaction that number is, and stays, zero. Don’t take our word for it: open your own Network panel and cross-check.

Network — redact.cloakapi.io Fetch/XHR

NameStatusTypeSize

No requests during redaction.

Extraction, detection, sealing and signing all ran with the recorder on. Nothing to show — because nothing was sent.

0 requests · 0 B transferred · 0 B resources

FOR THE PEOPLE WHO HANDLE THE HARD DOCUMENTS

Compliance, legal, HR, journalism, healthcare.

Three free documents a day, no account. Unlimited from $12/month — same table, same airgap.

See plans →