BASALT · JOURNAL
Sanitize Document, and the step after redaction
Acrobat separates two operations that both need to happen. Redact removes the content you marked. Sanitize Document removes the things that were never on a page: metadata, attachments, embedded scripts, hidden layers and remnants of earlier states.
Both are correct and both are necessary. The problem is organisational rather than technical: they are separate commands, so one of them can be skipped.
What survives a redaction alone
The document information dictionary and the XMP packet, which frequently carry author names, original file paths, previous titles and the identifier linking the file to earlier versions.
File attachments, which are whole documents living inside the document and are not visible when reading it.
Optional content groups that are switched off. The content is present, merely not drawn.
Form field values, which persist independently of what the page appears to show.
Earlier revisions, if the file was saved incrementally rather than rewritten, in which case the unredacted page may still exist earlier in the bytes.
Why the separation causes failures
Not because anyone disputes that sanitisation is needed, but because the redaction is the part that feels like the work. Once the black areas appear on screen, the job looks finished, and the second command is easy to skip under deadline pressure.
Every leak of this kind I have read about was performed by someone competent who was in a hurry.
Making it structural
The fix is to make sanitisation part of the same operation rather than a separate discipline. Basalt strips metadata, XMP, attachments, scripts and hidden layers as part of applying a redaction, writes the output as a single generation rather than an incremental append, and verifies all of it before the file is written.
That removes the possibility of doing half the job, which is more reliable than remembering to do both halves.
Checking either way
Whatever tool you use, the check is quick. exiftool -a -u -g1 file.pdf reads both metadata blocks. pdfdetach -list file.pdf lists attachments. Counting %%EOF markers reveals retained revisions. Doing this once on your normal output tells you whether your workflow has the gap.
Frequently asked questions
What does Acrobat's Sanitize Document do?
It removes content that is not part of the visible page: metadata, XMP packets, file attachments, embedded scripts, hidden layers and remnants of earlier document states. It is separate from redaction, which removes the content you marked.
Is redacting enough without sanitising?
No. Redaction removes what you marked on the page. Metadata, attachments, hidden layers, form field values and earlier revisions survive it, and each of those can carry the material you were trying to remove.
Why do people skip sanitisation?
Because redaction is the part that looks like the work. Once the black areas appear the document looks finished, and a second separate command is easy to forget under deadline pressure.
How do I check whether hidden data survived?
Run exiftool -a -u -g1 on the file to read both metadata blocks, pdfdetach -list to enumerate attachments, and count %%EOF markers to detect retained earlier revisions. A few minutes on a typical output tells you whether your workflow has a gap.
Doing it in Basalt
Basalt is a native macOS PDF toolkit with eighteen tools in one window: merge, split, compress, OCR, Bates numbering, privilege logs, forms, signing, watermarks, comparison and more. Redaction destroys content rather than covering it, and an independent verifier re-opens every written file and proves the material is gone before the file is saved. If it cannot prove it, nothing is written. A one time $29 licence covers up to three Macs, it is free for the first 24 hours, there is no account, and the engine holds no network entitlement at all, which macOS enforces at the code-signature level. Download it at basaltformac.com.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.