Discover · Search · Production

A redaction is a removal, never a black box

Redacted spans are removed from produced text — not drawn over it — with a stated basis on every redaction, a privilege log in the standard shape, and ethical walls enforced at the engine so even the counts cannot leak.

Grotabyte — Privilege & Redaction

Per [redacted · privilege] we should hold the response until counsel has reviewed the draft…

Basis: attorney-client privilegeledgered

one of seven stated bases — privilege, work product, PII, PHI, non-responsive, confidential, trade secret

Sealed native untouchedSHA-256 ✓

byte-identical, hash-verifiable — the redaction lives in the production

Redacted spans are removed from produced text — never a black box over selectable words

Where it starts

Counsel finds the passage in the reading pane: advice of counsel, a patient identifier, a trade secret. Select it, state the basis. A redaction without a basis cannot be defended, so the product will not record one.

How it runs

01
Select the span, state the basis
Seven bases ship: attorney-client privilege, work product, PII, PHI, non-responsive, confidential (protective order), trade secret. One click extends the redaction to every occurrence of the same text in the field.
02
Review suggestions — nothing auto-applies
The engine proposes spans (identifiers, account numbers, privilege markings) for a reviewer to confirm. An archive that silently redacts on a regex will eventually redact something responsive, and nobody will notice until it is produced.
03
Produce with the redaction in force
The produced text carries the redacted form — the span is replaced, not overlaid. The classic failure this prevents: an image that looks redacted while the load file hands over the text underneath it.
04
Withhold the native
A redacted document is never produced natively; the volume records it as withheld — redacted, produced as text only. The sealed native stays byte-identical and hash-verifiable, which is what lets a production be re-cut later under different privilege calls.
05
Log without revealing
The privilege log and the redaction log ship in the volume: basis, characters redacted, who applied it, when — and a hash of the covered text, never the text itself. Opposing counsel learns why and how much without learning what.

Why it holds up

The redacted excerpt is never stored anywhere — only its SHA-256. Storing it would recreate the exposure the redaction exists to prevent; the hash still proves later what was covered.

Removing a redaction keeps the record: the row is marked removed, by whom, when — because a challenge to a privilege call needs to examine exactly that history.

Ethical walls are enforced at one engine accessor covering hits, counts, facets, term reports, exports and family expansion — a facet histogram over the whole tenant would tell a screened reviewer what the other matter holds without showing a single document.

Walls fail closed: an engine that cannot answer 'is this inside' has not said yes.

Overlapping redactions are refused with the conflict named — no silent merging of two reviewers' different calls.

What you hand the regulator

A workflow that ends on a screen isn’t finished. This one ends in a document.

Privilege log + redaction log

Two logs in the production volume, in the shape opposing counsel and the court expect — disclosure about the withholding, without a second copy of what was withheld.

privilege log: log no · date · author · recipients · custodian · basis · description · withheld-or-redacted
redaction log: field · basis · characters redacted · applied by/at · excerpt SHA-256
DAT columns REDACTED and REDACTIONBASIS on every row
domain-exclusion log with the stated basis, when used

Adjacent workflows

Productions Search & Term Hit Reports Matters & Legal Holds

See it run on your data scenario

The demo form asks which workflows you want to see — name this one and we’ll stage it.

Book a Demo All workflows

How it runs

Select the span, state the basis

Seven bases ship: attorney-client privilege, work product, PII, PHI, non-responsive, confidential (protective order), trade secret. One click extends the redaction to every occurrence of the same text in the field.

Review suggestions — nothing auto-applies

The engine proposes spans (identifiers, account numbers, privilege markings) for a reviewer to confirm. An archive that silently redacts on a regex will eventually redact something responsive, and nobody will notice until it is produced.

Produce with the redaction in force

The produced text carries the redacted form — the span is replaced, not overlaid. The classic failure this prevents: an image that looks redacted while the load file hands over the text underneath it.

Withhold the native

A redacted document is never produced natively; the volume records it as withheld — redacted, produced as text only. The sealed native stays byte-identical and hash-verifiable, which is what lets a production be re-cut later under different privilege calls.

Log without revealing

The privilege log and the redaction log ship in the volume: basis, characters redacted, who applied it, when — and a hash of the covered text, never the text itself. Opposing counsel learns why and how much without learning what.