Redact PDF documents with local AI: true redaction, review and the workstation

Redacting PDFs with AI on your own workstation

You can redact PDFs with AI without uploading them anywhere: a detection step on your own workstation finds names, addresses, account numbers and other personal data, a redaction step deletes the text and image pixels under each mark, and a person checks the result before the file is shared. Open tools cover each step: Presidio and a local language model find the data, PyMuPDF or Stirling-PDF remove it, and OCRmyPDF makes scans readable first. By our users-per-card rule, one NVIDIA RTX PRO 4500 Blackwell with 32 GB runs the detection models and a 27-billion-parameter language model for a second reading.

The work is familiar in many offices. HR answers an employee's request for a copy of their file, and the file mentions colleagues. A legal team sends contracts and correspondence to the other side or to an expert. A public body publishes decisions or releases documents on request. An insurer passes a claim file to an outside assessor. Each time, names and numbers must go first, and by hand that takes hours for a thick file.

To redact means to remove information from a document permanently, so that it cannot be recovered from the file. This guide is about the PDF that leaves your organisation as a file that someone else will open, copy and search. Removing personal data before text reaches a language model or a search index is a different task, covered in our guide to PII redaction before an LLM, which also compares the detection models and explains how the GDPR treats anonymised and pseudonymised data.

A black box is not a redaction

A PDF page holds several layers: the text, which can be selected, copied and searched; images, which in a scan contain the whole page; drawings; and annotations such as comments and highlights that sit on top. A black rectangle drawn with a comment tool, or a highlight in black, is an annotation. It covers the name on screen and in print, while the text underneath stays in the file, where copy and paste or any text extraction finds it.

True redaction works in two steps. In PyMuPDF, a Python library for PDFs, a redaction mark is first placed on the page so that a person can see what will go. Applying the redactions then, in the words of its documentation, will "Remove all content contained in any redaction rectangle on the page". By default it removes every character whose bounding box overlaps a mark, blanks the overlapping pixels of images and removes the marks themselves. The library allows the text to be kept under a mark, and its documentation warns that this "does not comply with the data protection intentions of redaction annotations".

The same documentation states that text is physically removed from the page "assuming Document.save() with a suitable garbage option". Where a mark covers part of an image, PyMuPDF writes a new image for the page, and "The original image is not deleted or replaced as part of this process, so other pages may still show the original." Save the redacted copy with a garbage-collection option.

PyMuPDF documentation for Page.add_redact_annot and Page.apply_redactions, Stirling-PDF's Redact guide and Presidio's PDF annotation sample, read on 30 October 2026.

Stirling-PDF, a self-hosted PDF toolbox with 95.4k stars on GitHub on 30 October 2026, offers both steps in a web interface. Its Redact guide says that redaction "permanently deletes sensitive text and areas from a PDF, not just hides them", and advises: "Keep a copy of the original." Its automatic mode searches for words you enter, as whole words or as regular expressions, and the option "Convert PDF to PDF-Image" turns the redacted pages into images "so no text at all remains behind the boxes". The price of that option is that the text can no longer be selected or searched. Stirling-PDF finds only what you tell it to look for: its guide offers regular expressions for formats such as email addresses, which you enter yourself, and describes no automatic detection of personal data.

Presidio's PDF sample only adds highlights where it found personal data; its output "contains the original content", a good file for a reviewer and the wrong one to send out.

Finding personal data with patterns, detection models and a local LLM

Presidio, an open framework for "detecting, redacting, masking, and anonymizing sensitive data", is now an independent, community-governed project under the Data Privacy Stack organisation on GitHub and remains under the MIT licence. Its analyzer combines patterns, context words and named-entity recognition, a model that labels names, places and dates in running text. The current analyzer release is 2.2.366 of 27 October 2026, for Python 3.11 or later.

Its list of supported entities includes email addresses, phone numbers, persons, locations, dates and IBANs, which it checks by "Pattern match, context and checksum". A Germany section adds nine types: tax ID, tax number, passport, ID card, social security number, health insurance number, vehicle registration, commercial register entry and postcode, the last marked "High false-positive risk". The documentation is clear that "In its default configuration, it contains recognizers and models for English". German names in running text need a German model configured in the NLP engine, with the context words of the recognisers translated as the documentation recommends; Presidio supports spaCy, Stanza and transformers models for that, and its samples also show GLiNER and Flair models as external detectors.

A dedicated detection model can take that role. Fastino's GLiNER2 PII model, published under Apache 2.0, covers English, French, Spanish, German, Italian, Portuguese and Dutch with 42 types of personal data in a checkpoint of 1.23 GB. Its card reports a low precision of about 0.35 to 0.37 on the SPY benchmark and notes that it often labels common nouns and organisation or product names as personal names, so expect extra marks that the reviewer removes. Our PII redaction guide sets it against four other open models with their published scores.

A local language model adds what patterns and classifiers miss: indirect identifiers. "The colleague who came back from parental leave in March" names nobody and, in a team of twelve, still points to one person. A model on the workstation can read each page, list such passages with the reason, and pass them to the reviewer as proposals. It is slower than a detection model, and a passage it overlooks simply stays unmarked, so it complements the other two.

None of these tools promises completeness. Presidio's documentation says that its automated detection can miss sensitive information and recommends further safeguards, and that is why the review step below is part of the setup.

You can order the workstation alone, the setup of OCRmyPDF, Presidio, PyMuPDF and a local model alone, or both together: the workstation delivered with everything installed and configured; write to us and we suggest the best solution for your tasks and budget.

Redacting scanned PDFs starts with OCR

A scan is a picture of a page, and a picture has no text to search. OCRmyPDF, under the Mozilla Public License 2.0, "adds an OCR text layer to scanned PDF files" with the Tesseract engine, which recognises more than 100 languages. OCRmyPDF's own page names no GPU use for this default; its plugins for EasyOCR, for which a GPU is "strongly recommended", and for PaddleOCR, described as GPU-accelerated, use the graphics card.

After OCR, the detection runs on the new text layer, and the redaction has to remove two things: the text and the pixels of the scan image under each mark. With PyMuPDF's default setting for images, the overlapping pixels are blanked. A redaction that removed only the text would leave the name visible in the image. Handwriting, stamps and faint copies are where OCR fails and where a name can pass every automatic step, so scans deserve a closer look in review. Our guides to PDF parsing with Docling and MinerU and to vision-language models for document AI cover OCR and document models on GPUs.

Why companies and public bodies redact under the GDPR

Data minimisation is one of the GDPR's principles: under Article 5(1)(c), personal data shall be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". A contract that goes to an assessor rarely needs the private address of the signatory, and a decision that is published rarely needs the names of witnesses.

Access requests are the second reason. Article 15(3) states that "The controller shall provide a copy of the personal data undergoing processing", and Article 15(4) adds that "The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others." When an employee asks for their file, the names and details of colleagues in it are those others, and redaction is one way to meet that. Our guide to an AI server for HR and recruiting covers the other HR tasks on the same hardware.

Courts publishing judgments and public administration face the same question at scale; our guide to an AI server for courts describes it together with the AI Act point that applies. Running detection on your own workstation also means the unredacted file never goes to an outside service, which our guide to local AI and the GDPR discusses. This is general information on the GDPR text on EUR-Lex as of October 2026, not legal advice; what has to be removed in a given case is decided by your data-protection officer or legal counsel.

The review step before a file leaves

Automatic detection produces proposals. A short, fixed procedure turns them into a redacted file somebody can sign off:

1. OCR for scans, then detection with patterns, the detection model and, where needed, the language model.
2. Marks, not yet applied. Every finding becomes a redaction mark with its type, so the reviewer sees exactly what will go. An allow list keeps your own company name and public office addresses out of the marks.
3. Review. A person goes through the file page by page, removes wrong marks and adds missed ones. For publication, a second person checks the first.
4. Apply. Only now are the redactions applied, on a copy; the original stays in a protected location.
5. Verify. Extract the text from the saved copy and search it for every removed string; nothing should be found. Look at the images in the saved file, and check the document properties, comments, attachments and form fields, which are not part of the page.
6. Record. Log who approved the file and which types of data were removed, without logging the data themselves.

The reviewer is usually the slowest part, so the tools should help: marks grouped by type, the model's reason, and a jump from mark to mark.

We set up this procedure with your document types and your allow list; send us the kinds of files, their languages and the number of pages per month, and we come back with a configuration.

Which workstation or server for PDF redaction

Detection models are small next to the memory of the cards; the language model for the second reading decides the card. We size with our users-per-card rule: 90 per cent of the memory the driver reports, less 3 GiB per card, less the model weights. That leaves 18.5 GiB on a 24 GB RTX PRO 4000, 25.7 GiB on a 32 GB RTX PRO 4500, 61.5 GiB on a 72 GB RTX PRO 5000 and 83.0 GiB on any 96 GB RTX PRO 6000 edition.

Our estimate by the users-per-card rule. Weights: gpt-oss-20b 12.8 GiB and Qwen3.8-27B FP8 28.75 GiB as in our model guides; Qwen3.8-27B NVFP4 21.9 GB (20.4 GiB) and GLiNER2 PII 1.23 GB from the Hugging Face file pages, read on 30 October 2026.

On the RTX PRO 4500, NVIDIA's NVFP4 build of Qwen3.8-27B takes 20.4 GiB and GLiNER2 PII about 1.15 GiB, which leaves about 4.1 GiB for the pages in progress, by our estimate. NVIDIA's card for the build is Apache 2.0, "ready for commercial or non-commercial use". With the FP8 cache of its serving example, a page of a few thousand tokens with its instructions takes about a quarter of a GiB, by our arithmetic from the configuration file, so the remaining memory holds a dozen or more pages in progress. Our guide to Qwen3.8-27B on the RTX PRO 4500 Server Edition has the details. On the RTX PRO 4000, gpt-oss-20b leaves about 4.5 GiB beside the detection model, as our guide to 30B models on 24 GB cards shows for the model alone.

For speed there is one published measurement on this card family. StorageReview's review of 14 October 2026 measured Qwen3.8-27B in NVFP4 with vLLM 0.27.1 on the RTX PRO 4500 Server Edition in a Dell PowerEdge R770 server, at 512 input and 512 output tokens per request: 320 output tokens per second with 32 requests in parallel. With one request at a time, every card in that review landed between 17 and 22 tokens per second. The workstation RTX PRO 4500 has 896 GB/s and 200 W against the Server Edition's 800 GB/s and 165 W; no figure was published for it. As a worked example by our estimate: if the second reading returns about 150 tokens of findings per page, with the model's thinking mode switched off (it is on by default), a 200-page HR file needs 30,000 output tokens, 23 to 29 minutes one page at a time and less with pages in parallel. Reading each page adds processing time, for which no figure has been published on these cards; time a sample.

Licences, network and versions for IT

1. Licences. Presidio is MIT, OCRmyPDF MPL-2.0, Stirling-PDF MIT outside directories it lists with their own licences (its enterprise parts), and PyMuPDF is under the GNU AGPL v3 with "separate commercial licences available from Artifex for proprietary applications". If you build PyMuPDF into an application of your own, or offer redaction to users outside the company over a network, have the AGPL conditions checked.
2. No outbound calls. Presidio's documentation also lists remote recognisers that call cloud language services; leave them unconfigured, and serve the language model with vLLM on the internal network.
3. Versions. Pin Presidio, OCRmyPDF, PyMuPDF and the model, and rerun a labelled test set after every upgrade.
4. Storage. Keep originals, review copies and redacted files apart, with separate rights.

Our Private AI/ML service deploys open models on-premise with vLLM or Ollama, so the documents do not leave your network.

FAQ