Why a redaction tool should work with the network off
· 6 min read
A redaction tool should work with the Wi-Fi off, because the document you are redacting is by definition the one you cannot afford to have copied. If the app needs a server, the unredacted original goes to the server, and everything after that is a matter of trusting someone’s retention policy.
Turning the network off before you start is the only version of that promise you do not have to take on trust, and it takes a minute. Here is how to run the test, what an upload actually costs, and how to see what an app on your Mac can reach.
What offline has to mean, precisely
“We don’t store your files” and “runs on your device” get used for three different things, and the failure modes are not the same.
The file is uploaded and processed on a server. Deletion is a scheduled job, not an event. Backups have their own clock. The company’s obligations to you are whatever the terms say, and the terms can change.
The work happens locally but the app talks to a server anyway. Licensing, analytics, crash reports, update checks. The pages stay on your Mac, but a record of your activity does not, and a crash report can carry more of the document than anyone intended.
The part of the app that opens the document cannot reach the network at all. Not “does not”, cannot. This is the only one where the answer does not depend on the app behaving as described, and it matters most for the material people actually redact: client files, medical records, HR investigations, records responses, anything under a confidentiality clause.
Test it in a minute
No tooling required.
- Make a test PDF containing a string you will recognize, something like
ZQX-testphrase-77. - Turn off Wi-Fi from Control Center in the menu bar, and unplug Ethernet if you use it.
- Open the app and do a complete job: open the document, place marks, apply them, export the result.
- Watch for anything that spins, waits, times out or shows a sign-in prompt. Every one of those is a step that wanted a server.
- Turn the network back on and check the export properly, because a tool can be entirely offline and still leave the text sitting under the black box.
What an upload costs even when the service is careful
Assume for a moment that the service is run by decent people who do exactly what they say. There is still a bill.
You inherit their incidents. Their breach is your notification obligation, and you will find out on their timetable.
Your document becomes discoverable somewhere else. A third party holding a copy can be served with a request for it, and depending on the arrangement you may not be the one who is told first.
The upload itself can be the breach. For material covered by a confidentiality clause, a professional duty or a data protection agreement, sending it to an unapproved processor is the violation whether or not anything is ever leaked.
There is a paper trail you did not intend. An account, an email receipt, browser history, and often a file name in a log. A file name can be a fact about a case.
None of this requires anyone to behave badly. It is simply what happens once a second copy exists.
macOS already does the basic job offline
Worth saying plainly: for a short document, the tools on your Mac are offline and adequate.
Preview’s Tools, Redact genuinely removes the text and image content under the mark when you save, and it needs no network at all. Automator’s Extract PDF Text, mdls in Terminal, Quick Look and the Inspector are all local. Redacting a PDF in Preview covers what that tool does and where it stops.
The gaps are not about connectivity. Preview does not verify its own output, does not strip metadata, attachments or hidden layers, and does not find every instance of a term for you. Those are the reasons people go looking for something else, and the search is where an upload sneaks in.
One local thing worth checking: if your working folder is in iCloud Drive, macOS is syncing the unredacted original as you work, entirely legitimately. Keep sensitive work in a folder on the machine. Save new documents to your Mac instead of iCloud covers changing the default.
Checking what an app can actually reach
Three checks, in increasing order of how much they tell you.
Activity Monitor, Network tab. Open Activity Monitor from Applications, Utilities, select the Network tab and sort by Sent Bytes. Use the app for a few minutes and watch whether its row moves. This shows traffic that happened, not traffic that is possible.
Open sockets, in Terminal. With the app running:
lsof -i -P | grep -i basalt
Substitute the app’s name. Empty output means the process has no network connections open right now: a snapshot, not a guarantee.
Entitlements, in Terminal. This is the one that says something structural:
codesign -d --entitlements :- /Applications/YourApp.app
That prints the entitlements the app was signed with. In a sandboxed process, com.apple.security.network.client is what permits outgoing connections, and macOS refuses them if it is not there. The caveat matters: entitlements only constrain a process running in the sandbox, so for an app that is not sandboxed their absence tells you nothing. The question to ask is whether the component that opens your documents is sandboxed and network-free.
One correction to a common assumption while you are here: the firewall in System Settings, Network, Firewall blocks incoming connections. It is not a way to stop an app calling out.
A promise versus a constraint
A privacy policy is a promise about behavior. An entitlement is a constraint enforced by the operating system. For documents that carry real consequences, the second is the one worth paying for.
Basalt is built that way: the engine that opens your document runs as a separate process holding no network entitlement, enforced by macOS at the code-signature level, so the component that has your pages in memory cannot reach the network regardless of what the rest of the app does. There is no server, no account and no telemetry. The signed certificate it writes beside each export can be checked later with shasum and openssl, without the app and without a connection. It does not edit PDF text like a word processor, it cannot open a password-protected file you do not have the password for, and it works only on PDFs and images turned into PDFs.
Run the Wi-Fi test on it, or on anything else you are considering. An app that survives it has told you something a policy page cannot.
Questions
Does working offline make the redaction better? No, and conflating the two is a common mistake. Offline is about who else gets a copy of the original. A completely local tool can still leave the words under a black rectangle: why a black box on a PDF does not redact anything shows how fast that falls over. Check the output either way.
A web tool says it runs in the browser and uploads nothing. Is that true? Sometimes it genuinely is, and you cannot tell by reading the page. You can test it: load the page, turn the Wi-Fi off, then do the whole job including downloading the result. If it completes, the processing was local.
Is a license check the same problem as an upload? Not the same order of problem, but worth knowing which one you have. A check that sends a key and gets an answer is a different thing from a client sending document counts or crash reports. Run the Activity Monitor check and see what moves.
What about the scanner? A multifunction printer may be doing its own uploading, particularly if it offers scan-to-cloud or a built-in email feature. Scan to a folder on the Mac, and check what the device keeps.