Oxofolio scans a document for Indian identity and tax numbers, shows you each one in place on the page, removes it from the file itself, and then re-reads the finished document to confirm it is no longer there. All of it on the machine in front of you.
The usual way this goes wrong is not that somebody forgets to redact. It is that they draw a black rectangle in a PDF viewer, the digits stay in the file underneath, and the document now looks handled — which makes it more dangerous than it was before, because nobody will check it again.
The second way is uploading a client's KYC pack to a web redaction tool to get it done quickly. For a firm whose entire obligation is not to disclose that data, the fix and the breach are the same action.
Redact a number, then open the output in any PDF reader and try to select the text underneath the black mark. There is nothing there to select.
Every claim on this page is about a mechanism rather than an outcome, so each one is something you can verify rather than something you have to believe.
| Validated, not pattern-matched | Aadhaar, PAN and GSTIN each carry a check digit, and Oxofolio computes it. A twelve-digit invoice total is not an Aadhaar number, and a pattern match alone cannot tell the difference — which is how a scanner ends up either flooding you with false positives or being quietly ignored. |
| Every match shown in place | Before anything is removed you see each one where it sits on the page, ordered by severity. Nothing is redacted on trust. |
| Removed from the file, not covered | The text operators are deleted. The black mark is drawn afterwards, as the visible evidence that something was taken out — not as the thing doing the taking. |
| Read back and searched | The finished PDF is re-opened and searched for the values that were supposed to disappear. An operation that silently did not do what it said is the failure this is engineered against. |
| What the document says about itself, too | Author, the software that produced it, the old title, revision history and any embedded JavaScript can be stripped in the same pass. A redacted PDF that still carries the original filename in its metadata is not redacted. |
A tool that claims everything is a tool nobody can check. Each of these is a decision rather than a gap, and stating them here means the download contains exactly what this page described.
The same discipline runs through the security pack, where the unfavourable answers sit on the first page rather than the fourth.
Aadhaar, PAN, GSTIN, IFSC codes and Indian mobile numbers, with the checksum verified on those that carry one. Aadhaar can be masked in the UIDAI style rather than removed outright, where that is what the recipient needs.
Partly. IBAN, e-mail addresses and account numbers sitting next to a label that says so are found in any country. The rest of the shipped set is Indian — what that means where you are.
Yes, but as an image: the marks are burned into the pixel data and then read back out of the saved file and checked. A rectangle drawn over a photograph is not a redaction if the pixels beneath survive.
No. There is no lookup, no validation service and no network connection of any kind — the check digits are arithmetic, computed on your machine.
A black box over a number is not a redaction.
Make a scan searchable without sending it anywhere.
Forty protected statements, one pass, passwords you already have.