Silo Redact.
Redaction you can prove. Nothing leaves your Mac.
Real redaction, not a black rectangle
Silo Redact rebuilds each page from redacted pixels, so covered text cannot be copied, searched, or recovered — and the source file's text layer, form fields, and metadata are gone, not hidden.
Nothing is redacted until you accept it
On-device detection proposes; you dispose. A mandatory review queue means every redaction is your explicit call — the Apply button stays locked until the queue is empty.
Every export ships with a verification report
After burn-in, the output is independently re-checked: two text-extraction engines, a re-OCR sweep of the rendered pixels, and a metadata audit — with SHA-256 hashes of input and output.
Checksummed patterns (SSNs, card and routing numbers, EINs, emails, phones, dates), PDF form-field values, Vision OCR for scanned pages, and name/entity recognition — plus an optional local model for context.
Pending detections are drawn as hairline outlines; accepted ones fill solid ink-black. Apply stays disabled and labelled "Review N remaining" until you have judged every one.
The redacted file is re-checked after it is written and either certified with a report or quarantined as -FAILED-DO-NOT-SEND, so you never send a document that only looks redacted.
Point Silo Redact at a whole folder against a saved detection profile; every file gets its own burn-in and its own verification report.
Pattern, form, OCR, and name detection ship inside the app and need no download. The optional contextual model is a consent-gated download you can decline and still redact.