Find and remove repeated identifiers without reading every page

Redacting a two-page letter is a reading exercise. Redacting a 400-page disclosure bundle where an account number appears in a footer on every page is a different problem, and it is the one where people start skimming and missing things.

What detection is good at

The automatic identifier tool reads the document's text and matches patterns. It performs well on identifiers that have structure:

• Fixed-format national identifiers, where length and character composition are defined, and often a checksum confirms a candidate is real rather than a coincidental digit string.
• Payment card numbers, which validate against a check digit.
• Bank and account references following a known layout.
• Email addresses, which have an unambiguous shape.
• Phone numbers, within the formats you expect.
• Dates of birth, in recognised date formats.

Structure is what makes these tractable. A checksum means the tool can distinguish an actual identifier from an invoice total that happens to have the same number of digits, which sharply reduces the noise you have to wade through.

What detection is bad at

Be equally clear about the other half:

• Names. There is no pattern that distinguishes a person's surname from an ordinary word, and names vary enormously across languages and scripts.
• Addresses. Free-form, inconsistently formatted, and frequently spread across several lines.
• Contextual identifiers. "The claimant's daughter, then aged seven, attending the school opposite the station" identifies someone without containing a single detectable pattern.
• Unusual formats. An identifier written with spaces, hyphens, or line breaks in unexpected places may not match.
• Text inside images. A scanned page has no text to search. Recognition has to run first, and recognition errors mean identifiers can be missed.

This is why detection is a recall aid, not a substitute for judgement. It finds the repetitive, structured material that human reviewers miss through fatigue. Humans find the contextual material that no pattern can express. You need both.

The review step is the work

Every finding should be approved individually before anything is removed. That sounds tedious and it is the entire point.

Two failure modes it prevents:

• Over-redaction. The document's own reference number, the recipient's own account, or the sender's contact details are frequently detected and frequently should stay. Blanket removal produces a document nobody can use.
• Under-redaction by assumption. If you accept a detection run without reading it, you never notice that the tool found eleven instances of an account number on a document where you know it appears fourteen times.

Read the list, approve the true positives, reject the false ones, and pay attention to counts that look lower than you expect. Then do a manual pass for the categories detection cannot reach — names, addresses, and contextual identification.

Removal, not covering

The critical property is that approved values are removed from the document rather than covered with a shape. A drawn rectangle leaves the text underneath fully selectable, which is the failure behind a long series of public redaction incidents. The redaction guide covers why that keeps happening and what correct removal looks like.

For material that must not be recoverable, the secure redaction tool burns the result into image-only pages and validates that hidden content is gone. That is heavier — the output is no longer searchable — and it is the right trade for high-stakes disclosure.

Verify before release

Detection plus approval plus removal still ends with verification. Do not skip it:

1. Open the output and select all the text on the affected pages.
2. Paste into a plain text editor and search for the values you removed, and for fragments of them.
3. Search for the values with different spacing and separators.
4. Run the privacy scanner over the output to catch metadata, annotations, attachments, and hidden layers that page-level redaction never touched — the privacy audit guide explains why those survive editing.
5. Record what you checked, so the removal is demonstrable rather than assumed.

Because all of this runs in the browser, a disclosure bundle full of exactly the identifiers you are trying to protect does not have to be uploaded to a third party in order to be cleaned. For regulated material that is not a convenience — it is often the difference between a defensible process and a reportable one.