Cross-posted from Medium. Originally published at https://medium.com/data-science-collective/redacting-pii-100-offline-a-technical-deep-dive-a326f9fed3b8
If you handle contracts, medical records, legal discovery, or even just research data, redacting PII is not optional. HIPAA, GDPR, PCI, FOIA — they all want it gone. And yet the tools we reach for are stuck in two failure modes.
The first is the cloud route: you upload a document full of the exact personal data you're trying to protect, and a server sends back a "redacted" copy. That's a privacy paradox — you solve the privacy problem by first exposing the document. For anything sensitive, that's a non-starter.
The second is the manual route: draw black rectangles over every SSN by hand. Slow, error-prone, and because most viewers black the rendering rather than the text, the layer underneath can often be selected or deleted to reveal what was "redacted." Or the tool auto-blacks whole lines and you get a wall of censor bars.
Neither is good enough. I wanted accurate, automatic, value-only redaction that runs on my own machine. So I built one. (If you want the tool and not the story, it's here: github.com/monjurulkarim/privateredact.) This post walks through how it works — extraction, hybrid regex + local-LLM detection, the part nobody gets right (drawing the box), and proving the output is actually clean.
