Skip to content

Handle citizen data without sending it to the cloud.

Redact case files, correspondence, and records entirely on-premise.

Where sensitive data leaks out

Government and public bodies hold citizen records that must stay within jurisdiction. Cloud tools and pasted prompts move that data across borders and outside the control of the agency.

What the disclosure rules actually require

Records requests are not a privacy problem with a disclosure exception. They are a disclosure duty with narrow, enumerated privacy exceptions, and that inversion is what makes them hard. Under the US Freedom of Information Act an agency must release records unless one of nine exemptions applies. Exemption 6 is the personal one, covering personnel, medical and similar files whose release would be a clearly unwarranted invasion of personal privacy. In practice agencies use it to remove names, Social Security numbers, home addresses, telephone numbers, dates of birth and medical information. European public bodies face the same shape of problem under national freedom of information law read together with GDPR, and public administration is one of the sectors NIS2 designates as essential.

Redact as narrowly as possible

Removing a whole page or a whole field is over-redaction, and over-redaction is itself a failure to disclose. The duty is to remove the exempt information and nothing more.

Release reasonably segregable material

Where a document holds both exempt and non-exempt content, the non-exempt portions must still be provided. A record cannot be withheld in full because part of it is sensitive.

Cite a specific exemption for every redaction

Each withheld item has to be justified individually. A response that removes material without saying which exemption authorises it is incomplete, and it is a common ground for a successful appeal.

The documents this actually applies to

Records and information requests

PERSON, ADDRESS, PHONE, EMAIL, DATE_OF_BIRTH, national ID numbers

The core workload. Third-party names and contact details usually come out under the personal-privacy exemption while the substance of the record stays in. Volume is the difficulty: one request can run to thousands of pages, reviewed against a statutory clock.

Correspondence and casework files

PERSON, ADDRESS, EMAIL, case reference numbers

Constituent and complainant correspondence carries identifying detail in running prose rather than in tidy fields, which is exactly where manual review misses things. The complainant often needs removing while the complaint itself is disclosed.

Procurement and contract records

ORGANIZATION, IBAN, bank details, supplier contact names

Commercial confidentiality and personal privacy overlap here. Supplier banking details and named individuals come out; pricing and terms usually stay in, because transparency in procurement is the reason the record is disclosable at all.

Meeting recordings and minutes

PERSON, ADDRESS, health and family circumstances raised in session

Committee and board sessions routinely name residents and discuss their circumstances aloud. Omit Meet transcribes locally and redacts the transcript, so minutes can be published without the recording ever leaving the building.

What a narrow redaction actually looks like

Before

Complaint 2026-0412 was filed by Margaret Whitfield of 14 Ashcroft Lane, reachable on 0161 496 0132, regarding refuse collection on the Brackley estate.

After

Complaint 2026-0412 was filed by [PERSON_1] of [ADDRESS_1], reachable on [PHONE_1], regarding refuse collection on the Brackley estate.

The complaint, the reference number and the location of the service failure all survive, because none of them are exempt. Only the complainant is removed. That is the narrow redaction the statute asks for, and the labels make the removal visible rather than hiding it behind a black rectangle.

The audit report is the exemption log

Every Omit run writes an HTML report listing each detection, its type, its location in the document and the operator applied to it. For a records officer that is not a convenience feature: it is the per-item justification the statute requires, produced automatically instead of maintained by hand in a parallel spreadsheet. When a requester appeals, the report is the contemporaneous record of what was removed and why, written at the time of the redaction rather than reconstructed months later.

What records teams ask first

Can this run in an air-gapped environment?

Yes. Omit needs no network connection at any point, including activation, which uses an offline Ed25519 key rather than a licence server. Agencies on isolated networks can install and run it without an exception to their connectivity policy.

Does redacting a PDF actually remove the text underneath?

Yes. Omit performs true PDF redaction: the underlying content is removed from the file, not covered with a drawn rectangle. Drawing a black box over text is the failure behind most published redaction incidents, because the text stays selectable in the released file.

What about scanned documents?

Scanned pages go through bundled OCR, which runs locally like everything else. Detections are mapped back to box coordinates on the page so the redaction lands in the right place on the image.

Can we show an appeal body exactly what was removed?

The per-run report lists every detection and the operator applied to it. Because it is written during the run, it stands as a contemporaneous record rather than an after-the-fact reconstruction.

Does citizen data ever leave our jurisdiction?

No. There is no upload, so there is no cross-border transfer to assess and no processor to contract with. For GDPR purposes the transfer rules in Article 44 and the chapter that follows are simply not engaged.

Can we keep a reversible mapping for internal use?

Yes, through the encrypted vault, which keeps the mapping locally so tokens can be resolved by authorised staff. Note the legal distinction: reversible tokenisation is pseudonymisation, not anonymisation, so the data remains personal data because the mapping exists. Use irreversible operators when the original is genuinely not needed again.

Further reading

  • How to Permanently Redact a PDF

    Most PDF redaction draws a black rectangle over text that is still sitting underneath it, recoverable with a copy-paste. Omit removes the text itself, checks the result before writing the file, and runs entirely offline, no Adobe required.

  • How to Unredact a PDF, and How to Prevent It

    Most recovered redactions come back the same trivial way, because a black rectangle is a drawing and the text is still underneath it. Here is why it happens, how to tell which kind you are holding, and what actually removes a value.

  • What Does Redacted Mean?

    Redacted means information was deliberately removed from a document before it was released, usually shown as a black bar. Here is where the word comes from, why documents get redacted, how it differs from censorship, and whether the hidden text can be recovered.

  • How to Redact PII From Images

    Omit redacts PII inside PNG, JPEG, TIFF and BMP files the same way it redacts documents: OCR reads the text, the same detector finds the PII, and the matching regions get blacked out in the image itself, entirely on your machine.

Data never moves, so European data residency is inherent and offline rollout fits air-gapped environments. Nothing depends on a network the agency does not control.

Serve citizens without exposing them.