Skip to main content
Version: v2026.0.0

Redaction

Redaction in ARender is a mechanism for permanently removing sensitive content from documents. Although redaction annotations look similar to other annotations in the XFDF layer, they are architecturally distinct: they interact with the document rendering pipeline, PDF content streams, and an authorization gate that other annotation types do not touch.

This page covers the conceptual model.

Two phases: marking and burning

Redaction is a two-phase process:

1. Marking

A user places redaction annotations on the document. At this stage, a redaction is just an annotation — it is stored in the annotation layer, it can be moved, resized, or deleted, and it does not alter the document content in any way.

Redaction annotations carry properties specific to their role:

PropertyPurpose
overlayTextText displayed over the redacted area (e.g. "REDACTED")
overlayTextRepeatWhether the overlay text repeats to fill the area
interiorColorFill color of the redaction rectangle
coordsList of rectangles defining the redacted regions

2. Burning

When the user triggers a redacted export, ARender produces a new document where:

  • The redaction rectangles are permanently drawn as opaque shapes
  • The underlying text is removed from the PDF content stream — it is no longer selectable, searchable, or extractable
  • The original document remains untouched

This is handled by the redaction engine in the Document Converter, which parses the PDF content stream token by token and replaces text that falls within redaction rectangles with spacing adjustments.

Marking is reversible. Burning is not. Once a redacted document is exported, the original content under the redaction cannot be recovered from the output.

The authorization gate

ARender introduces an authorization layer that determines what a user sees when redaction annotations exist on a document — even before any burning occurs.

The document is rendered according to the user authorization:

Authorization resultUser sees
AuthorizedThe original document — redaction annotations are visible as overlays but the content beneath them is fully readable
Not authorizedA redacted rendition — redaction annotations are burned on-the-fly into the rendered pages, and the content beneath is hidden

This means that non-authorized users cannot see through redaction annotations, even before an explicit export. The redaction is enforced at the rendering level.

Default behavior

By default, only users with an admin username (admin, administrator, or p8admin) are authorized to view the original content beneath redaction annotations.

How redaction differs from other annotations

AspectRegular annotationsRedaction annotations
StorageAnnotation layer (XFDF)Annotation layer (XFDF) — same
Effect on documentVisual overlay onlyCan permanently alter the document content on export
RenderingAlways shown as-isBurned into the rendition for non-authorized users
Content streamNot involvedThe redaction engine removes text from PDF content streams
ReversibilityAlways reversible (just delete the annotation)Reversible while marking; irreversible after burning
  • Annotations — the annotation model that redaction builds on