Self-hosted redaction, 8 questions to ask before documents leave your network

When a legal or finance team asks IT to approve a redaction tool, the conversation usually starts with features. It should start with where the documents go. Here are eight questions worth asking any vendor, Ombly included.

1. Where does processing actually happen?

"Secure cloud" can mean many things. Ask whether the unredacted original is sent anywhere outside your infrastructure, even briefly, and whether any part of the work, such as OCR or AI detection, calls an external service.

2. What's stored, and for how long?

Originals, converted copies, page images, extracted text and detection results are all sensitive. Ask which of these are kept, where, and whether they're encrypted at rest.

3. Who holds the keys?

If the vendor holds the encryption keys, the vendor can read the documents. For self-hosted deployments, you should hold them, and you should know what happens to existing documents and backups if a key is lost.

4. Is redacted content removed, or covered?

Ask what the exported file contains. A redaction that draws a box over text leaves the text in the file. A safer export has no text layer, metadata, comments, attachments or earlier revisions from the original.

5. Does detection fit your documents?

Client documents carry account numbers, IBANs and national IDs in many formats, plus matter numbers and internal references. Ask which identifiers are built in, how false positives are reduced, and how you add your own patterns.

6. Can a person review before release?

Automatic detection should suggest, not decide. Ask whether every suggestion must be reviewed, whether reviewers see the actual final file before it's shared, and whether separate reviewer and approver roles exist.

7. What does the audit trail record?

You want who did what, when, and to which document, plus counts by category and a checksum of each export. You don't want the audit log itself to become a copy of the sensitive text.

8. How is it deployed and backed up?

Ask how it's installed (for example, containers on your own servers or cloud), whether it needs internet access at runtime, how backups are encrypted, and whether restores have been tested.

How Ombly answers them

Question	Ombly for teams
Where processing happens	On your servers or cloud. Processing workers have no internet access, and OCR runs locally
What's stored	Originals and derivatives, encrypted at rest with AES-256-GCM; originals are kept separately from exports
Who holds the keys	You do. Keys are created on your side during setup
Removed or covered	Every exported page is rebuilt from pixels; nothing from the original PDF is copied
Detection	Card numbers, IBANs and Aadhaar numbers checked against checksums; US SSN, UK National Insurance, PAN and IFSC formats; names, addresses, emails, phone numbers, file paths and your own patterns
Review	Every suggestion must be decided, and the final file confirmed, before download. Today one administrator reviews; separate roles are on the roadmap
Audit trail	Uploads, reviews, exports and downloads, with categories, counts and checksums, never the matched text
Deployment and backup	Containers on your infrastructure, with encrypted backups and a tested restore process

If those answers fit your requirements, book a call and we'll talk through your setup. For a broader view, see how we compare or read redacting client documents in-house.