Built for regulated documents

Dr. Redact LLC acts as a Business Associate when processing Protected Health Information (PHI) on behalf of a covered entity or business associate under an executed Business Associate Agreement. The BAA is available on every paid plan and can be executed electronically from account settings; the full text is published at /baa.

The free trial does not permit PHI. Trial users must affirmatively confirm this restriction before their first upload, and the confirmation is recorded with a timestamp and IP address.

At rest: every document is encrypted with AES-256 using AWS KMS-managed keys (SSE-KMS) the moment it reaches storage. Buckets are fully private — public access is blocked at the account policy level.

In transit: all connections use TLS 1.2+ with TLS 1.3 preferred, end to end — browser to application, application to storage, and every subprocessor connection.

Access: documents are only ever reachable through short-lived presigned URLs (15-minute expiry) generated after authentication and ownership checks. No document URL is ever permanent or guessable.

Redaction is pixel-level destruction, not an overlay: pages are rasterized and rebuilt, so the original text within redacted regions is permanently destroyed and cannot be recovered from the delivered document. Every processed document can include an audit certificate recording the certificate ID, timestamp, operator, and per-category redaction counts.

Retention runs from upload. Users receive expiry warnings 7 days and 1 day before deletion.

User-initiated: any document can be permanently deleted at any time. Deletion issues hard storage-level delete operations for the original, the redacted output, and the certificate — there is no soft-delete or recycle bin — and records an audit entry (who, what, when, why).

Automatic: documents are deleted when their retention period ends. As defense in depth, storage lifecycle rules independently enforce expiry at the infrastructure level, so retention holds even if the application layer fails.

Logging hygiene: application logs never contain document content — only metadata such as counts, categories, timestamps, and event names.

Authenticationis handled by Clerk with session management and optional Google OAuth; every application route and API endpoint requires an authenticated session, and every database query for document data is scoped to the requesting user — one user can never address another user's documents.

Least privilege:the application's cloud credentials are limited to the specific storage, encryption, and OCR operations the service requires. Administrative functions are gated by a database-level owner flag on top of authentication — not by client-side claims.

Time-limited access: documents are reachable only through signed URLs that expire after 15 minutes, generated per request after ownership verification.

Processing activity, deletions, and administrative actions are recorded in centralized audit logs (event, actor, timestamp, and affected resource — never document content). Deletion events additionally record the reason and the specific storage objects removed.

In the event of a security incident affecting customer data, we notify affected customers in accordance with our contractual commitments and, where PHI is involved under an executed BAA, within the timelines required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414). Security reports: support@drredact.com.

Dr. Redact practices data minimization: we store only your account identity (via our authentication provider), billing state (via Stripe — card numbers never touch our servers), your documents for their retention window, and processing metadata. Documents are processed solely to provide the redaction service and are never used to train AI models.

The rights of access, rectification, and erasure are supported directly: document deletion is self-serve and immediate (see above), and full account deletion can be requested at support@drredact.com. Processing currently occurs in the United States (us-east-1); EU customers should review our Privacy Policy for transfer details.

For agencies responding to FOIA and state public-records requests, Dr. Redact produces release-ready documents: exemption-covered material (personal identifiers, law-enforcement-sensitive details) is permanently removed rather than masked, the review step gives a records officer item-by-item control, and the audit certificate documents what was withheld and when — supporting the justification trail that accompanies a response.