BASALT · JOURNAL
Redacting HR and employee documents
HR documents move between more hands than most people expect: legal, external counsel, an insurer, an investigator, sometimes a regulator. Each hop is a chance to disclose something that was never meant to travel.
What usually has to come out
Names of complainants and witnesses, where anonymity was offered or is required.
Identifiers belonging to other employees who appear incidentally, such as in an email thread or a shared calendar entry.
Home addresses, personal phone numbers, personal email addresses and national insurance or social security numbers.
Medical information, which in many jurisdictions carries obligations of its own separate from ordinary personnel data.
Compensation detail for people who are not the subject of the request.
The parts that get missed
Email headers. A thread exported to PDF carries every recipient in the To and Cc lines, including people whose involvement was not meant to be visible.
Document metadata. The author field frequently names whoever drafted the file, and the original file path can reveal a folder structure naming a case or a person.
Tracked changes and comments in documents converted from Word. Converting to PDF does not always discard them, and a comment can contain the frank internal assessment that was never meant to leave.
Attachments. A PDF can carry whole files inside it that appear nowhere on any page.
The check that catches all of it
Extract the text of the finished document and search it for the names you removed. Read its metadata. List its attachments.
If a name you redacted appears in the extraction, the tool covered it rather than removed it, and the document is not ready to send.
A note on investigation files
Investigation material is frequently the most sensitive HR output and the most likely to be produced in a dispute later. It is worth treating as litigation material from the outset: redact properly, keep the unredacted original, and record what was removed and why.
This is a description of common practice rather than legal advice. Obligations vary by jurisdiction and by the terms you are working under, and the authority that governs your work is the one to check with.
Frequently asked questions
What should be redacted from HR documents?
Names of complainants and witnesses where anonymity applies, identifiers of unrelated employees appearing incidentally, home addresses and personal contact details, national identification numbers, medical information, and compensation detail for people who are not the subject of the request.
What is most often missed when redacting employee files?
Email headers carrying every recipient, document metadata naming the drafter and the original file path, tracked changes and comments surviving conversion from Word, and file attachments that appear on no page.
How do I check an HR redaction worked?
Extract the text of the finished document and search it for the names you removed, then read the metadata and list attachments. If a redacted name appears in the extraction, it was covered rather than removed.
Should investigation files be handled differently?
They are usually the most sensitive HR output and the most likely to surface in a later dispute, so it is worth treating them as litigation material from the start: redact properly, retain the unredacted original, and record what was removed and why.
Doing it in Basalt
Basalt is a native macOS PDF toolkit built around redaction that removes content rather than covering it. After writing a file it re-opens its own output with an independent parser, searches for the material again, and refuses to save if anything is found. It also strips metadata, XMP, attachments, embedded scripts and hidden layers as part of the same operation, and a separate Inspector reports what any PDF still hides, including documents Basalt did not create. Everything runs on your Mac: the engine holds no network entitlement at all, which macOS enforces at the code-signature level. A one time $29 licence covers up to three Macs, free for the first 24 hours. basaltformac.com, or brew install --cask chipmunk1101/tap/basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.