Static website
The workspaces are served as static files. None needs a document processing API.
Security
Security model
RedactNinja is designed around local browser processing. This page explains the security position of the workspaces and the controls reviewers should understand.
Three separate workspaces
RedactNinja SAR at app.redactninja.com is for case evidence and disclosure. RedactNinja PDF at pdf.redactninja.com is for general document editing and conversion. RedactNinja Image at image.redactninja.com is for photos and screenshots; its AI models are served from the same site and run in the browser. All three process selected file contents locally. The case-specific controls described below belong to the SAR workspace; an ordinary PDF download is not an encrypted case file.
None of the workspaces includes this public website's advertising or analytics scripts. Local processing does not protect files already downloaded to a shared device. Keep original documents and verify outputs before sharing them.
Local file handling
Selected files are read by the browser tab rather than uploaded to a RedactNinja server.
Manual review
The product helps reviewers find content. It does not replace DPO or legal judgement.
What happens in the browser
- The user selects files from their device: PDFs, images, spreadsheets or email evidence such as PST, MSG, MBOX and mailbox ZIP exports.
- The browser reads the file and creates suggestions for review.
- The user chooses which items to redact or clears suggestions that should remain visible.
- Exports are created as local downloads when the user clicks an export button.
- Encrypted case files are protected with the password typed by the user.
What the workspaces are not intended to do
- It is not a cloud document processing service.
- It is not a long term case management database.
- It is not a legal decision system.
- It is not a replacement for checking redacted outputs before disclosure.
Current controls
- HTTPS is enforced, with HSTS, on this website and all three workspaces.
- Directory listing is disabled.
- Each site sends its own security headers, including a Content Security Policy. The workspaces use a stricter policy than this public website.
- Advertising and analytics scripts are not included in any workspace.
- Diagnostic logs are not shown in the live app and are not included in the disclosure pack.
Current limits
Browser based processing depends on the user's device, browser and available memory. Very large PDFs, scanned documents and OCR runs should be trialled before high volume use. Redacted outputs should be manually checked before disclosure.
Responsible reports
Please send suspected security issues to security@redactninja.com. Do not include live SAR material in an ordinary email report unless a secure process has been agreed.