On-device redaction masks sensitive values at the point of detection, on the endpoint, so the unredacted value never enters an event record, a log line, or a network request. It is masking, destructive and irreversible, not tokenisation.
Three techniques
Only one of them is redaction.
The word is used loosely in this market. ***-**-6789 is masking: there is no key anywhere that restores it.
Hashing deserves a specific warning. An SSN has roughly a billion possibilities, so an unsalted hash of one is recoverable by brute force in seconds. A hash is not redaction for low-entropy identifiers. If a product stores hashed identifiers server-side, the salt handling is the whole question.
| Technique | Reversible? | What it is for |
|---|---|---|
| Masking / redaction | No: characters destroyed | Keeping the value out of every downstream system |
| Tokenisation | Yes, with the vault key | Preserving referential integrity; a payments pattern |
| Hashing | Not directly; brute-forceable at low entropy | Matching and deduplication |
Where it happens is the point
“We redact sensitive data” describes two very different systems.
Redact at rest, server-side. The raw value was transmitted, processed, and probably logged somewhere in the path before redaction occurred. The claim is about the final database row.
Redact at detection, on-device. The unredacted value never populates a serialisable structure at all.
Only the second means the value never left the machine. Ask which one, and ask where in the code path masking is applied.
What correct implementation requires
What to check, starting with when the masking happens.
- 01
Mask before the record is constructed
Not before it is transmitted. The window between those two points is where leaks live.
- 02
Apply it to logs too, including debug builds
Most real PII leaks in security products are a debug print somebody forgot to remove, not an exfiltration feature.
- 03
Get the span right
A finding with the correct type and the wrong offsets means part of the real value survived into the record. Span accuracy is a redaction property, not a classification nicety.
- 04
Encrypt the local buffer anyway
Defence in depth: treat even redacted records as sensitive at rest.
- 05
Enforce it in CI
So the property is a build gate rather than a convention.
Questions
Why mask at detection rather than before sending?
Because the window between those two points is where leaks happen. Once an unredacted value has been written to a log line, a queue, a crash report or a debug build, masking it on the way out does not reverse that.
Does redaction mean the security team cannot investigate?
No. The record carries the finding type, the count, the destination, the action and a masked snippet, which is enough to run an assessment by category. What it does not carry is the sentence, which is almost never what the investigation needed.
Is a masked value reversible?
It should not be. Masking that can be undone is encryption with extra steps, and it moves the question to who holds the key. An identifier keeping its last four digits is a display convention, not a reversible transform.
What about logs and debug builds?
They are where most redaction failures actually live. Redaction that applies in production but not in a debug build is redaction that leaks on the machine of whoever is diagnosing a problem, which is a real path and a commonly missed one.
Does on-device redaction slow the machine down?
It runs inside the budget the send already has. The practical constraint is a deadline rather than throughput: if detection has not finished in time the send proceeds, because a control that freezes somebody's browser gets uninstalled.
Can the vendor still see the original text?
That depends entirely on where classification executes. If it runs on the endpoint, the vendor never receives the text. If it runs in the vendor's cloud, the content is in their systems whatever the redaction policy says afterwards.
Keep reading
- Product Privacy architecture Itzal runs detection on the endpoint and transmits only a redacted event record. Read the page
- Product Detection engine Itzal's detection runs locally in layers, patterns, contextual inference, framework mapping. Product page
- Product Itzal Guard Checks what people type, paste and upload into ChatGPT, Claude, Gemini and seven other AI tools. Product page
- Glossary AI DLP Data loss prevention applied to the prompt layer, and why files, email and network traffic are the wrong place to look. 4 min read