Security and data handling

Redactly processes documents that contain personal data, so the security model is deliberately small: text is redacted in memory, responses are returned synchronously, and request bodies are not written to storage.

Updated 26 October 2026

How your data is handled

  • In memory only. Request bodies are redacted in the running process and returned in the response. Redactly does not persist submitted text or files.
  • No training on customer data. Documents you send are not used to fine-tune or otherwise train the detection model.
  • API keys are hashed. Keys are generated with 192 bits of randomness, prefixed rdct_, shown once, and stored only as a SHA-256 hash. Revoking a key takes effect immediately.
  • Output is irreversible. Replaced, masked, and removed spans cannot be recovered from the redacted output. If you need reversibility, keep the original in your own system.

Transport and infrastructure

  • The marketing site is served by Cloudflare Pages with HSTS enabled, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a restrictive Content Security Policy.
  • All traffic is served over HTTPS. Plain HTTP requests are redirected to HTTPS with a 301.
  • The API runs as a container behind an HTTPS proxy with a health check and automatic restart on failure.
  • The API only accepts cross-origin browser requests from the Redactly domains. Other origins are rejected by CORS.

Compliance frameworks

Redactly is designed for teams operating under GDPR, HIPAA, and CCPA, and maps its controls to SOC 2 and ISO 27001.

  • GDPR — data minimisation by design: only the text you submit is processed, and nothing is retained.
  • HIPAA — redaction of the 18 identifier categories before data reaches analytics or downstream systems.
  • CCPA — removal of personal information from datasets before sharing or export.

Enterprise plans include a Data Processing Agreement and a configurable retention policy. Ask us for the current security documentation before your procurement review.

Responsible disclosure

If you believe you have found a vulnerability, email [email protected] with steps to reproduce. Please do not open a public issue or test against data that is not yours. We aim to acknowledge reports within two business days.

Contact

Security and procurement questions: [email protected] · +91 94074 59327