PDF PII & Secret Redactor

Remove common personal identifiers and credentials from text-based PDFs in bulk. The default secure browser workflow lets a user upload private files from the run's Live View without making them public or selecting an Apify storage resource. The Actor finds selected PII and secret types, applies real PDF redaction annotations, clears optional metadata and attachments, saves the sanitized PDF, and then reopens it to verify that matched text is no longer extractable.

This is a deterministic privacy utility, not an AI guesser and not a claim of legal compliance. It never places complete detected values in its dataset or logs.

What it detects

• Email addresses
• International and North American phone-like numbers
• Validly structured U.S. Social Security numbers
• Payment-card numbers that pass the Luhn checksum
• IBANs that pass the MOD-97 checksum
• Valid IPv4 addresses
• JSON Web Tokens
• AWS access-key IDs
• API keys, client secrets, access tokens, and bearer tokens with an explicit label
• Up to 100 literal custom terms, such as a client name or case number

Secure browser upload (recommended)

1. Leave Secure browser upload selected and start the Actor.
2. Open the running Actor's Live View tab.
3. Choose one or more PDFs, select detectors or custom terms, and click Process selected PDFs.
4. Save each redacted PDF. After the final save starts, the Actor run ends successfully on its own.

Apify does not currently auto-open an Actor's Live View after Start, so step 2 is required by the platform. View in a new window is optional.

Original browser uploads are read directly by the isolated run and processed in memory. They are not written to an input Key-value Store. Redacted PDF bytes are transferred directly into the browser and are not written to Actor storage either. Only a minimal report with generic document numbering and finding counts is saved. Live View downloads require the session's unguessable CSRF token; no permanent signed-public output URL is created for browser uploads.

The secure page has no external scripts, analytics, fonts, AI service, storage picker, or account-wide permission request. It closes after four minutes of inactivity or twenty minutes total.

URL/API batch mode

For automations, select Advanced URL/API batch and provide authorized public or signed HTTPS PDF URLs. URL query strings are encrypted in Actor input and removed from dataset reporting. The downloader never attaches the Actor run token to a document request.

What you get

URL/API batch mode writes a detailed document report containing finding counts, types, page and bounding-box evidence, warnings, a SHA-256 source fingerprint, and a signed link to the redacted PDF in run storage. Sensitive values are represented only by a masked hint and a SHA-256 digest.

Secure browser mode intentionally saves less: generic document numbering, counts, types, warnings, cleanup status, verification status, and billing fields. It does not save the original filename, source fingerprint, finding coordinates, matched-value hashes, or either PDF version. The redacted PDF is transferred into the browser during the live session.

The OUTPUT key contains the run summary. Redacted files use predictable keys such as REDACTED-0001-contract.pdf.

Example input

{
  "mode": "url_batch",
  "documents": [
    {
      "url": "https://example.org/authorized-contract.pdf",
      "name": "contract"
    }
  ],
  "action": "redact",
  "detectors": [
    "email",
    "phone",
    "ssn",
    "credit_card",
    "iban",
    "jwt",
    "aws_access_key",
    "api_secret"
  ],
  "customTerms": ["BLUE MARBLE"],
  "labelMode": "type",
  "removeMetadata": true,
  "stripAttachments": true
}

Output example

{
  "documentIndex": 1,
  "name": "contract.pdf",
  "status": "redacted",
  "pageCount": 12,
  "findingCount": 7,
  "findingTypes": {
    "email": 3,
    "phone": 2,
    "ssn": 2
  },
  "outputRecordKey": "REDACTED-0001-contract.pdf",
  "verification": {
    "performed": true,
    "passed": true,
    "remainingTextMatches": 0
  },
  "warnings": []
}

Scan-only mode

Set action to scan to produce the same structured report without creating or changing a PDF. This is useful as a release gate in document workflows.

Safety controls

• Only http and https PDF URLs are accepted.
• Local, private, link-local, reserved, multicast, credential-bearing, and nonstandard-port URLs are blocked to reduce SSRF risk.
• Redirect destinations are validated again.
• Downloads, document counts, page counts, and timeouts are bounded.
• Custom terms are escaped literal text; user-supplied regular expressions are not executed.
• Reports and error rows do not contain complete detected values.
• URL query strings and fragments are removed from result rows so signed-download parameters are not copied into the dataset.
• Secure browser uploads and their redacted outputs never enter a Key-value Store and never receive signed-public output URLs.
• The secure upload page uses bounded raw-body streaming, CSRF protection, no-store browser headers, a restrictive content-security policy, and no request-path logging.
• The Actor run token is never attached to document-download requests.
• Redact mode removes embedded attachments by default because their contents are not scanned.

Important limitations

• Version 1 scans the PDF text layer. It does not perform OCR on scanned pages or redact text baked into images. Pages without extractable text are explicitly listed and warned about.
• Pattern matching can produce false positives or miss context-dependent PII. Review the output before publication or disclosure.
• Passwords entered in Live View exist only in the running container's memory. Passwords supplied in URL/API input are encrypted with the Actor input. In both cases, use short-lived document-specific passwords, never an account password.
• The Actor is a technical aid, not legal advice, a certification, or a guarantee of GDPR, HIPAA, CCPA, FOIA, or other compliance.
• Process only documents you are authorized to access and modify.

Support

When filing an issue, include the run ID, whether the affected page has selectable text, and a non-sensitive sample if possible. Never paste private information or credentials into a public issue.