Trust Center

Automated detection suggests information to review and can miss sensitive material. You choose what to remove and what to keep, and you can draw boxes for anything detection missed. Oddseal does not edit your PDF: it renders every page to a fresh 240-DPI image with the approved masks burned into the pixels and builds a new PDF with one image per page. The output carries no text layer, fonts, hidden text, source metadata, attachments, annotations, JavaScript, optional-content layers, or edit history from the source.

Before the output can be downloaded or shared, an independent reader opens the stored file and confirms the expected page count, no extractable text, and no attachments, JavaScript, or open action, together with a structural check of the file. If that check fails, download and sharing stay locked. The check confirms how the file was built. It does not search the output for each selected value, compare unmasked content with the source, or show that every sensitive item was selected. A value you do not select stays visible, and a document may still be identifiable from the details left visible. The output is an image, so its text cannot be searched.

• Invited users sign in with a verified email and password. OAuth, multi-factor authentication, and trusted-device sign-in are not offered yet.
• Account sessions have a seven-day sliding expiry. Sessions can be revoked, and changing or resetting a password revokes all sessions.
• Each product request checks current workspace membership. Stored document records are associated with their owning workspace.

A share link carries access to one redacted PDF that passed its pre-share check. You can label it for a recipient, set its expiry, and revoke it. Anyone who has the link can use it while it is valid; the recipient label is not an identity check.

Oddseal records link opens with limited, pseudonymous access information. This does not prove which person opened the PDF. Expiry or revocation stops future access through the link, but cannot delete copies already downloaded or stop someone from sharing those copies.

• Published redacted PDFs use private object storage with short-lived signed access. A shared link serves only the redacted PDF. Original PDFs remain in the originating browser.
• Detected values and review decisions remain in browser storage and are not included in server backups. Share tokens are stored as hashes.
• Unfinished drafts expire after 14 days; verified local originals after 1–168 hours, default 72. Cleanup runs when the app opens or returns to the foreground; a closed browser cannot delete at an exact time. Published-document deletion revokes access immediately and targets primary purge within 24 hours; local draft deletion is separate.
• Uploaded documents are not used to train models. Oddseal does not send document content to external AI services.

Hosted telemetry is limited to allowlisted, content-free events, aggregate metrics, and scrubbed exceptions. It excludes document text, detected values, filenames, customer emails, raw document/share identifiers, bodies, headers, tokens, and full URLs with queries.

Access is by invitation, and the service is best effort. Public account signup, billing, and team features are disabled. There is no uptime SLA or choice of processing region. Oddseal is not an archival backup; keep required original records in your own system. The PDF engine currently has outbound network access, so this page does not promise that processing is isolated from all external networks.