Encryption, masking, and being honest about security
Why our redaction tool is called "Mask PDF (visual only)", and how password protection works when the whole thing happens in your browser.
By the RatioAI team
Security features are where PDF tools most often oversell. A tool says "redact", you draw black boxes over a name, you send the file, and the recipient copies the text right out from under the boxes. It happens more often than you'd think.
So we made a decision early on: every security-related tool in RatioAI should say exactly what it does, even when that sounds less impressive.
Masking is not redaction
Our current tool for covering parts of a page is called "Mask PDF (visual only)". It draws opaque shapes over the regions you pick. That's useful for quick screenshots or casual sharing. But the original text and images can still exist underneath in the file.
True redaction means actually removing the underlying content from the document structure, not just painting over it. That's harder to do correctly, and until we can guarantee it, we're not going to call the tool something it isn't. If you need legally defensible redaction, the label tells you to look elsewhere for now.
Password protection, done locally
The Protect PDF tool adds a password using AES-256, the encryption standard used across the industry. The interesting part is where it happens: your password and your document are combined right inside your browser tab. The password is never sent to us, and neither is the file.
That also means we can't recover a forgotten password. There's no copy anywhere except in your head (or your password manager). We'd rather say that plainly than pretend otherwise.
Small things that add up
A few other choices come from the same mindset:
- Remove Metadata strips author names, software tags and XMP data that often leak more than people expect.
- Flatten PDF bakes form fields and annotations into the page so they can't be quietly edited later.
- Unlock PDF only works when you already know the password. It's for removing protection from your own files, not breaking someone else's.
- Tools that need a server are badged clearly, so you always know when a file would leave your device.
Where this is going
Our upcoming Business and Enterprise plans add things like audit logs, signing workflows with a proper audit trail, SSO, and on-prem deployment for organisations with strict compliance needs. Those features will follow the same rule: clear labels, no overselling, and as little data leaving your control as possible.
If you've got questions about how any of this works, or you spot something we could explain better, we'd genuinely love to hear from you at [email protected].