What to redact, by document type: for people and firms

Most documents you share were never meant to be shared in full. The person receiving them usually needs one or two facts, such as your income, your address or a signature, and none of the identifiers around them. This guide lists common documents and what to hide on each.

Two rules apply everywhere:

• Hide what the reader doesn't need. If they only need to confirm it's you, the last four digits of an ID are often enough.
• Remove, don't cover. A black box drawn over text usually leaves the text in the file. Use a tool that removes content, and check the result.

United States

Document	What to hide
Social Security card and SSN on forms	The SSN, or all but the last four digits
Driver's license and passport	License or passport number, date of birth and address
W-2, 1099 and tax returns	SSN, employer identification number, and amounts the reader doesn't need
Bank and brokerage statements	Account and routing numbers, card numbers
Medical bills and insurance statements	Member and policy IDs, diagnosis details and provider account numbers
Rental and job applications	SSN, dates of birth, and references' contact details

The UK and Europe

Document	What to hide
National ID cards and passports	Document number, date of birth and the machine-readable zone at the bottom
Bank statements and invoices	IBAN and BIC, card numbers
Payslips and P60s (UK)	National Insurance number, tax code, bank details
Tax letters	Tax identification numbers, such as Germany's Steuer-ID or the Netherlands' BSN
Utility bills used as proof of address	Account and meter numbers; keep the name and address
Rental applications	ID numbers, salary details beyond what's asked, and credit report reference numbers

Companies and firms

Firms share other people's documents, which raises the stakes. Common examples:

• Law firms: contracts and NDAs, case bundles and disclosure, witness statements. Hide client and third-party identifiers, bank details, and file paths printed in headers and footers.
• Accounting and audit: audit evidence, ledgers, payroll extracts. Hide employee IDs, salaries beyond the sample needed, and bank details.
• Banks, lenders and fintechs: KYC and AML packs, loan files. Hide ID numbers and account details when files go to vendors, partners or regulators that don't need them.
• HR teams: offer letters, appraisals, investigation reports. Hide ID numbers, salaries and the names of people who aren't party to the matter.
• Deal teams: data-room documents. Hide personal data in employee and customer contracts before buyers see them.

For firms, where the redaction happens matters as much as what is removed. Uploading client files to an outside service may conflict with engagement terms, internal policy or data protection law, wherever you work. We cover this in redacting client documents in-house.

India

Document	What to hide
Aadhaar card	The first eight digits of the 12-digit number. UIDAI offers a masked e-Aadhaar that does this
PAN card, salary slips and Form 16	The PAN, bank account and employee ID, unless the recipient needs them
Bank statements and cheques	Account number, IFSC code, card numbers and UPI IDs
Rent agreements and KYC forms	Aadhaar and PAN of every party, phone numbers and email addresses

What Ombly catches today

• Built in, anywhere: card numbers (checked with the Luhn checksum), IBANs (checked with the IBAN checksum), US Social Security numbers, UK National Insurance numbers, bank account numbers near words like "account", emails, names, addresses and file paths.
• Built in, for India: Aadhaar (with its checksum), PAN, IFSC, Indian phone numbers, and Indian passport numbers next to the word "passport".
• Your own patterns: teams add rules for anything else. These examples work in Ombly as written:

Identifier	Pattern
US Employer Identification Number	[0-9]{2}-[0-9]{7}
Canadian Social Insurance Number	[0-9]{3}-[0-9]{3}-[0-9]{3}
An internal matter number	MAT-[0-9]{4}-[0-9]{3}
A client reference	CL-[A-Z]{2}[0-9]{5}

Whatever Ombly suggests, a person reviews it before anything is exported. Automatic detection helps you find things; it isn't a guarantee.

Ombly runs on your own computer, or on your company's own servers for teams. Join the waitlist, or if you're a firm, book a call.