BASALT · JOURNAL
Redact a PDF before uploading it to an AI tool
Giving a PDF to an AI service is a disclosure of the file as it exists at upload time. Redacting afterward cannot undo it. Before using any service, check whether the data may be sent there, which account or enterprise terms apply, how inputs are retained, and whether your organization has approved the workflow.
Minimize before you redact
Start by removing pages the task does not need. If the goal is to summarize one contract clause, do not upload the full due-diligence binder. Data minimization reduces both review work and the consequences of a missed identifier.
Create a disclosure list covering client and employee names, contact details, account and record numbers, dates, signatures, confidential project names, privileged communications, trade secrets, and any regulated data. Context matters: a job title or rare medical condition may identify someone without a name.
Clean the whole PDF container
Page redaction must remove text objects and image pixels, including invisible OCR beneath scans. Then inspect metadata, comments, form values, attachments, bookmarks, hidden layers, hyperlinks, JavaScript, and earlier revisions. The AI service may extract these programmatically even if its viewer never shows them.
Do not assume a black box is safe. If the underlying characters remain, machine extraction is exactly the operation most likely to find them.
Verify and keep a disclosure record
Reopen the sanitized copy with a parser independent of the editor. Extract all text, search the approved removal list, inspect images and attachments, and confirm the file contains only the pages needed. Record the exact file hash, destination service, account context, purpose, and approval.
If policy does not allow the upload, use an approved local model or work from a manually prepared excerpt. Cloud PDF tool risk explains the same boundary for document editors.
Frequently asked questions
Does an AI service see hidden PDF text?
It may. Services often extract content programmatically, including OCR text and document structures that are not visible in an ordinary viewer.
Is replacing names with initials enough?
Not necessarily. Other details can re-identify a person, and the original names may remain in metadata, comments, or attachments.
Should I upload the redacted file to test it?
No. Verify locally before the first upload. Testing by uploading defeats the purpose if the file still contains sensitive data.
Doing it in Basalt
Basalt removes selected text and pixels, strips hidden PDF data, and independently verifies the sanitized file before it is written. The engine that opens the confidential source has no network entitlement, so preparation itself cannot upload the document. Get Basalt.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.