A document is not what you see when you open it. It is that, plus a second layer the editor shows only if you ask for it, and which whoever receives the file can read without asking anyone. Text cleaned line by line can still carry the client’s name in four different places, none of which you find by rereading.
These are the five that come up most often.
1. Tracked changes and comments in a .docx
If the document went through a review with change tracking on, every substitution you made is still inside the file: the new text and the old one, with the author and the timestamp. Accepting the changes is not enough if the comments stay, and comments carry a name in the margin. The command you want is the one that deletes tracked changes and comments, not the one that hides them.
2. File properties
A .docx and a PDF carry a properties block nobody ever looks at: author, last author to save, company, title, sometimes the folder path it was generated from. The “Author” field is almost always a real person’s name, and a PDF exported from Word also picks up the original document title, which is often the client’s surname followed by a matter number.
3. The text under a rectangle
Drawing a black rectangle over a PDF removes nothing. The rectangle is a graphic object placed on top, and the text stays underneath: it can be selected, copied and read with any tool that extracts PDF text. It is the mistake that has put more than one official document in the news, and exploiting it takes no skill.
Real redaction removes the text from the file and then draws over it. If the tool you are using does not say explicitly that it deletes, it is only drawing.
4. The text layer of a scan
A PDF made by a scanner is an image, but it almost always has a text layer underneath produced by optical character recognition, because that is what makes the document searchable. Covering the image leaves the text layer intact. The same rule as above applies, with the extra problem that here you cannot even see the text by selecting it: it is there, and one extraction pulls it out.
5. File names and paths
The last layer sits outside the document. An exhibit called Rossi_appeal_final_v3.pdf gives the surname before anyone opens it, and a zip archive carries the folder structure it was made from. If the file gets uploaded somewhere, the name travels with it.
6. What images bring with them
A photograph placed in a filing (the state of a property, damage, a document photographed rather than scanned) carries its own EXIF metadata: the camera model, the date and time of the shot and, where the phone had location switched on, the coordinates. A site visit thereby becomes an address accurate to a few metres, inside a document the addresses had been taken out of.
Then there are two cases nobody expects. The first is the screenshot: somebody captures a window of the practice system to show a detail, and the title bar or the column beside it carries the client’s name. The second is the chart pasted from a spreadsheet, which in many formats is not an image at all: it is an object carrying the data that generates it, and that data is the whole table, including the rows the chart does not show.
7. Version history
The last layer is not in the file: it is in the service the file lives in. A document kept in an online store keeps its own version history, and the previous version is the one with the names in it. Cleaning the document by editing it in place takes nothing away from anybody: it merely moves the intact copy one click further along, where it stays available to everyone with access to the file.
The same goes for sharing: sending a link to a document means sending its past too, and sending a downloaded copy means sending only its present. That is why a cleaned copy has to be created as a new file rather than obtained by changing the original, and why a tool that writes its result beside the original, rather than over it, is not doing so out of formality.
How to check without trusting
There is one check worth doing: extract the text from the finished file and read it. Not reopen it in the editor that produced it, which shows what it has decided to show, but pull the raw content out and search it for the values that were supposed to be gone. If a surname is still there, you see it immediately.
In practice it is two gestures, and neither needs software you have to buy. A .docx is a compressed archive. Take a copy, rename it to .zip, open it and look at three files: word/document.xml, which is the text; word/comments.xml, which is the comments; and docProps/core.xml, which is author, title and dates. A PDF goes to a tool that extracts its text without displaying it, and you search the result for the surname. If it turns up, the black you were looking at was a drawing.
Run the check on the file you hand over, not the working one, and run it once per type of document and workflow rather than per matter: if your way of exporting a PDF leaves the metadata in, it always leaves it in, and finding that out once is enough to change it forever.
That is the check Omissia runs before handing over a copy: the file that appears next to the original has tracked changes resolved, comments removed and properties emptied, and if the cleanup fails the file is not handed over. The rest of the argument is in the other two pieces: what leaves the office when a filing ends up in a chat window, and why redacting and substituting are not the same thing.