Redact personal data from a PDF so it is gone, not just covered

We share signed contracts with counterparties, auditors and occasionally a court. Before they go out, a handful of things have to come off the page: personal identification numbers, home addresses, and the bank details of anyone who is not a party to that particular copy.

The problem with what we use now

Our current editor draws a filled rectangle over the text. The text is still in the file. Anyone can select it, copy it, or read it out of the raw PDF in a text editor. We have had one near-miss with a document that went to an external auditor.

What redaction has to mean here

• The text objects are removed, not covered.
• The page is re-rendered so nothing sits underneath the mark.
• Metadata goes too — author, producer, and any XMP that carries a name.
• The result still opens as a normal PDF and still prints.

Nice, but not required

Being able to redact by pattern — "every string that looks like an IBAN on every page" — would save us the most time. But a reliable manual redaction we can trust beats a clever one we have to check.