Key Takeaways
- Scanned discovery documents often contain hidden data—metadata, comments, invisible layers, and OCR text—that standard black-box redaction tools may miss, creating serious privilege and confidentiality risks.
- Fully local PDF redaction on a Mac eliminates the cloud-upload risk entirely: the file never leaves your device, removing exposure from third-party servers, data breaches, and cross-border transfer rules.
- macOS-native tools like Preview and built-in Shortcuts only offer partial redaction; they cannot reliably remove hidden layers, OCR text, or metadata from scanned PDFs.
- Browser-based tools such as OctopusPDF process files 100% locally on your device—no cloud upload is involved—while providing sanitization features that go beyond visible black bars [K1].
- For scanned discovery, the safe workflow is: OCR locally (if needed), flatten the PDF, apply redaction with a local-capable tool, sanitize metadata, and verify the output before production.
1. Introduction
Discovery is where cases are won—and where confidentiality is most easily lost. Law firms routinely handle scanned documents: old contracts, medical records, correspondence, and exhibits that were physically printed before being scanned into PDFs. When those documents contain privileged material, protected health information, or trade secrets, redaction becomes a professional and ethical requirement, not a technical nicety.
What many lawyers do not realize is that redacting a scanned PDF on a Mac is not the same as redacting a Word document. A scanned PDF is effectively a container for images. The text you see on screen may be an invisible OCR layer sitting on top of a picture. The "black bar" you draw with a standard tool may only cover the visible pixels, leaving the hidden text intact. To make matters worse, if you upload that file to an online redaction service, you are handing the opposing party's potential evidence—or your client's deepest secrets—to a third-party server.
This article addresses a specific, practical question: how can a lawyer redact scanned discovery documents on a Mac without uploading the file to the cloud? We will walk through the risks, the available local tools, the exact redaction workflow, and the verification steps that protect both you and your client. The focus is on process, not just software—because the tool is only as safe as the workflow around it.
2. The hidden risks in scanned PDFs: why visible black bars are not enough
The core problem
The most common redaction mistake is assuming that drawing a black rectangle over text is sufficient. For a scanned PDF, that assumption is dangerously wrong.
Here is what typically happens. A lawyer or paralegal opens a scanned PDF in a standard viewer, draws a black box over a sensitive paragraph, and exports the file. On screen, the text is invisible. But the underlying image data may still contain the full text. If the PDF was OCR'd at any point—either during scanning or through a later processing step—the hidden text layer can persist beneath the visible black mark. Copy-and-paste, a quick search in a document reviewer, or a simple extraction tool can retrieve that "redacted" text instantly.
Beyond the OCR layer, scanned PDFs can carry other embedded data:
- Hidden annotations—comments or sticky notes added by previous reviewers, often invisible in standard viewing modes.
- Embedded metadata—file creation date, author, device name, or even GPS coordinates from mobile scanning apps.
- Invisible objects—stray text blocks, watermarks, or layers that were accidentally included during the original scan or subsequent edits.
The standard "black box" approach in Preview, Adobe Acrobat's free viewer, or many online editors only applies a visual cover. It does not destroy the underlying data [K1].
Why this matters in litigation
Redaction failures are not theoretical. Courts have sanctioned firms for producing documents where redacted text was recoverable. The cost of such an error goes beyond embarrassment—it can drive settlement leverage, expose privileged strategy, or trigger malpractice claims.
The practical takeaway: redaction of scanned discovery must remove the underlying data, not just obscure it visually. That requires a tool that physically deletes the pixels and any connected text layer, then flattens the document so no residual information remains.
3. The Mac-native landscape: Preview and local tools for basic redaction
If you are working on a Mac, the good news is that you have several options that do not require a cloud upload. The bad news is that they vary significantly in what they actually remove.
Preview.app (built into macOS)
Preview is the default PDF viewer on every Mac. For casual redaction, it offers limited functionality:
- Visible markup: You can draw shapes, including opaque black rectangles, over content.
- No true redaction: Preview does not provide a dedicated redaction tool. When you export the file, the underlying image data and any hidden text remain intact. The black rectangle is just a drawing object layered on top—it can be moved, deleted, or extracted by anyone with basic PDF skills.
Verdict: Preview is fine for marking up a draft for internal review. It is not safe for producing redacted discovery documents to opposing counsel.
macOS Shortcuts and Automator
Some workflows use Shortcuts or Automator to convert, flatten, or process PDFs locally. These shortcuts can do useful things—converting images to PDF, merging files, or compressing pages—but they do not provide pixel-destructive redaction. At best, they prepare the file for a dedicated redaction step; at worst, they create a false sense of security.
The missing piece: a local redaction engine
The core limitation of macOS-native tools is that redaction requires a two-step process: (1) visually covering the content and (2) internally removing the underlying data before the final save. Native tools often skip step 2.
This is where browser-based tools that process files 100% locally become relevant—even though the word "browser" may sound like cloud processing. The key distinction is where the computation happens. With local browser tools, the JavaScript code runs on your Mac's own processor. The file is loaded into memory on your device, processed on your device, and exported from your device. The server never receives or handles the document [K1].
4. Browser-based local processing: how tools like OctopusPDF redact without uploading
The architecture difference
When a tool says "processed 100% locally in the browser," it means the entire pipeline—reading the PDF, rendering pages, applying redaction, and producing the output—is executed in the browser tab on your own computer. Under the hood, it relies on open-source PDF libraries such as PDF.js and pdf-lib, which are common in the development community [K1]. Because the file never leaves your device, there is no upload endpoint, no third-party storage, and no transmission over the internet.
This is not the same as a "cloud-free" desktop application in a traditional sense, but it achieves the same privacy outcome: no network transfer of your document.
How redaction and sanitization work
In the context of discovery, a robust local tool should offer a redaction/sanitization function that does more than draw black boxes. It should:
- Physically remove the selected content—deleting the underlying image regions or OCR text rather than simply overlaying them.
- Strip metadata—eliminating author, creation date, device info, and other embedded fields [K1].
- Purge hidden content—removing comments, annotations, and invisible layers that a standard viewer would not show [K1].
- Produce a flattened output—so there is no separate layer from which text can be recovered.
This aligns with what platform-level tools like OctopusPDF call "Redact / Sanitize": physically deleting metadata, comments, and hidden content before sharing [K1]. That language is important—it signals the difference between visual cover-up and true destruction.
Why this matters for Mac users
Mac users are often constrained by the availability of professional desktop software. Adobe Acrobat Pro offers full redaction, but at a subscription cost. Preview is free but insufficient. Downloadable open-source tools like qpdf or exiftool can be installed through Homebrew, but they require command-line familiarity and do not provide the visual interface most lawyers need.
The practical gap: a visual, point-and-click redaction tool that runs locally on a Mac. Browser-based local processing fills that gap without asking you to install software or expose documents online. It also works consistently across Mac models, since nothing is installed at the operating system level.
5. A step-by-step workflow for redacting scanned discovery on a Mac
Regardless of the specific tool you use, the redaction workflow for scanned discovery should follow the same disciplined sequence. Each step is designed to close a specific leak point.
Step 1: OCR locally (if needed)
If your scanned PDF has never been OCR'd, you may need to run OCR to make text searchable—both for your own review and for accurate redaction. Do this with a local OCR tool if the original file lacks a text layer. If you use a browser-based tool for OCR, ensure it processes locally.
Step 2: Identify sensitive content
Make sure you know what needs redaction before you start. In discovery, this often covers:
- Attorney-client privileged communications
- Confidential settlement figures
- Personal data (social security numbers, medical details)
- Work product analysis or strategy notes
Search the document for keywords and review page images side by side. Flag every instance, not just the first occurrence.
Step 3: Apply redaction with a true sanitization tool
Use a tool that explicitly deletes content—not one that only draws shapes. Content should be selected, redacted, and then exported with a sanitization pass that flattens layers and removes metadata. OctopusPDF's Redact / Sanitize functionality is one example of a tool designed for this: it physically deletes metadata, comments, and hidden content in one action, with no upload involved [K1].
Key checkpoints:
- Select the region covering all sensitive pixels, not just the text glyphs.
- Redact, then verify the output within the tool.
- Sanitize before export to remove residual hidden data [K1].
Step 4: Verify before production
Open the exported PDF in a separate viewer. Try selecting text where the redaction was applied—if any text can be selected, copied, or searched, the redaction failed. Also inspect document properties for leftover metadata. If possible, extract the text with a tool and search for the redacted terms.
Step 5: Produce and log
Produce the redacted PDFs, but also keep an unredacted copy in a secure, access-controlled location. Maintain a redaction log indicating which pages, which regions, and under which privilege claim each redaction was made. This protects you during discovery disputes.
6. FAQ
Q1. Is using a browser-based tool the same as uploading to the cloud?
No. A browser-based tool that processes files 100% locally in your browser does not upload your file anywhere. The document is read, processed, and exported from your device's memory using client-side JavaScript [K1]. You can disconnect from the internet after the page loads and the redaction will still work. To confirm, look for a tool that explicitly states "no upload," "local processing," or "files never leave your device" [K1].
Q2. Can Preview safely redact scanned PDFs on a Mac?
No. Preview's drawing annotations are visual-only; they do not remove underlying image data, OCR text, metadata, or hidden objects [K1]. If you produce a Preview-annotated PDF as a redacted discovery document, sensitive content is likely recoverable. Use a tool with a dedicated redaction/sanitization function instead.
Q3. What is the difference between "redact" and "sanitize"?
In practice, redaction refers to covering or removing visible content, while sanitization refers to stripping non-visible data—metadata, comments, hidden layers, and OCR text—that remains in the file after visual redaction [K1]. A complete workflow should perform both. For legal documents, sanitization is not optional; it is a required step to prevent data leakage.
Q4. Is there a free option that truly deletes content locally?
Yes. Some browser-based tools offer free tiers with local processing. OctopusPDF, for example, provides a free starter plan with 3 conversions per day and file sizes up to 20 MB, no account required, delivered through fully local processing [K1]. The free tier is sufficient for smaller discovery sets; larger or higher-volume workflows would require a paid plan with higher file-size limits and batch processing [K1].
7. Conclusion
Redacting scanned discovery documents on a Mac is a task that demands more than a quick black box. The hidden layers that sit inside scanned PDFs—OCR text, metadata, invisible annotations—can survive visual redaction and expose confidential information in the most damaging way possible: silently and after production.
The solution is not to abandon Macs or to trust Preview, but to adopt a workflow built around true sanitization. The safest approach combines:
- A local-first redaction tool that physically deletes content and metadata [K1].
- A disciplined verification step to confirm nothing remains extractable.
- A documentation process that logs what was redacted and why.
For most Mac-using lawyers, browser-based tools with 100% local processing offer the most practical path. They provide a visual interface, run on the device itself, and eliminate the ethical and contractual risks of sending discovery documents to a remote server. No cloud upload, no residual data, no avoidable exposure.
Choose your tools with that standard in mind—your client's confidentiality depends on it.