Silo Redact.
Review, burn in, and verify PDF redactions entirely on your Mac.
Available todayReal redaction, not a black rectangle
Silo Redact rebuilds each exported page from redacted pixels, so covered text cannot be copied, searched, or recovered from the output. The exported file no longer carries the source text layer, form fields, or metadata.
Available todayNothing is redacted until you accept it
On-device detection proposes; you dispose. A mandatory review queue means every redaction is your explicit call. The Apply button stays locked until the queue is empty.
Coming in version 1.3.0The PDF and its report are separate saves
After burn-in, the output is independently re-checked through two text extractions, structural checks, re-OCR, metadata audit, and whole-file carving. You explicitly save the PDF and verification report as separate artifacts.
Available today + coming in 1.3.0.
Checksummed patterns (SSNs, card and routing numbers, EINs, emails, phones, dates), PDF form-field values, Vision OCR for scanned pages, and name/entity recognition, plus an optional local model for context.
Page thumbnails lead to exact source boxes with confidence, reason, and origin. Confirm or reject by pointer or keyboard; Apply remains locked until every finding has a user decision.
The redacted file is re-checked after it is written. A passing run makes the PDF and report available as separate saves; a failing run is quarantined as -FAILED-DO-NOT-SEND instead of being presented as ready.
Scan a folder against a saved detection profile, then open each file's pending findings in Review. Batch never accepts or applies a finding for you.
Pattern, form, OCR, and name detection ship inside the app and need no download. The optional contextual model is a consent-gated download you can decline and still redact.
The pinned Gemma 4 E2B 4-bit model adds contextual detection only. Before its roughly 3.58 GB download, Silo Redact shows the exact host, Gemma license, integrity policy, storage location, 5 GB free-disk requirement, and device-fit guidance. Decline it and the built-in pattern, form, OCR, and name tiers remain available.