ON-DEVICE DOCUMENT REDACTION

Redaction,
with a receipt.

Lay a sensitive document on the table. It detects, you review, and between the two of you far more is caught than either alone — then it seals itself and signs a receipt recording that detection and redaction ran on your device.

No “finds every name” promises. A detector finds the standard PII; a human catches the rest; the receipt proves exactly what was sealed.

AIRGAP LIVE watching every connection that leaves this origin

0 bytes to another origin

0 off-origin requests · 0 same-origin sends · 0 asset loads from here

“Sends” are outbound requests to this site itself — account and billing only. The redaction flow makes none, and no request of any kind carries your document.

⌥ Open your browser’s Network panel and watch. The first redaction downloads the on-device name model from this site (~139 MB, inbound). After that, every redaction runs at zero — and nothing outbound, ever.

THE EXAMINATION TABLE

Lay a document on the table

Drag it here, or . It is read in this browser tab — it never leaves your device.

.txt.md.csv.json.html .pdf .docx — soon

Multilingual name detection RECOMMENDED On-device · ~135 MB one-time download, cached · finds names in non-Latin scripts (Cyrillic, CJK, Arabic, Devanagari, Greek, Hebrew, Thai and more) by context. Nothing is sent — the model runs in this tab. The built-in Latin detector always stays on. On by default. It loads the first time you redact a document.

THE SELF-REFUTING PITCH

Every other redaction tool asks you to upload the sensitive file first.

To remove the secret parts, they first take a copy of the whole thing onto their servers. You have to trust a policy. cloak-redact never receives the file at all — extraction, detection, redaction and signing all happen in this browser tab. There is no upload to trust, because the document is never part of any request. The only thing our server ever handles is your account and payment — and only when you ask it to.

Everyone else your file → their server → redacted copy

cloak-redact your file → stays here → redacted copy

CHAIN OF CUSTODY

Four moves, all on your side of the airgap.

Detect

A WASM engine reads the text and finds names, emails, phones, cards and IDs — in the tab, with no model call.

Review

You see every candidate and decide. Reveal a false positive, or select any missed text to redact it yourself. Live secrets stay locked.

Seal

Redactions stamp into place. Real values become safe stand-ins so the document still reads; secrets and your catches become opaque marks.

Prove

A device key signs a chain-of-custody receipt — counts, categories, hashes, and a record that the cloaking pipeline ran before egress. It verifies offline, forever.

THE MOAT, MADE VISIBLE

Feel the silence.

The meter isn’t decoration — it installs a real instrument that watches every connection this tab makes and counts the bytes leaving this origin. During redaction that number is, and stays, zero. It also counts outbound requests to this site itself, separately, so a same-origin send can’t hide behind the headline — the redaction flow makes none of those either. Don’t take our word for it: open your own Network panel and cross-check.

Network — redact.cloakapi.io Fetch/XHR

NameStatusTypeSize

Nothing sent during redaction.

Extraction, detection, sealing and signing all ran with the recorder on, and not one request left this tab carrying anything. The single line you may see on your first redaction is inbound: this site handing your browser the ~139 MB on-device name model. It is a download, not an upload — after it, the panel stays empty.

0 outbound requests · 0 B sent · 0 B of your document

FOR THE PEOPLE WHO HANDLE THE HARD DOCUMENTS

Compliance, legal, HR, journalism, healthcare.

Three free documents a day, no account. Unlimited from $12/month — same table, same airgap.

See plans →