What Each One Removes
Redaction permanently removes visible content from a PDF page: text, images and vector regions inside the marked areas. Sanitization permanently removes hidden, non-visual content from the file's internal structure: metadata, XFA, XMP, embedded scripts, form data and hidden layers. They are different operations, and a document that has been redacted but not sanitized can still carry extractable data.
What Redaction Removes
Redaction removes what a reader sees on the page. The PDF redaction library works in two steps. Redact annotations mark the regions or text to remove, either by hand or programmatically through text search and pattern matching. The apply step then destroys the text, image and vector content inside those regions.
Nothing sits behind a clipping path or an image mask. That is the line between true redaction versus visual masking. Once applied, redaction is permanent and irreversible.
What Sanitization Removes
Sanitization removes what a reader cannot see but a program can extract. PDF sanitization strips metadata, XFA, XMP, embedded scripts, form data and hidden layers from the file's internal structure. The content on the page stays. Your team uses it to release a document without leaking its history or embedded data.
Side by Side: What Each Operation Touches
Each row names one thing a PDF can hold. Each column shows whether the operation removes it.
Where Each One Runs, and What It Costs to License
Redaction runs in the browser with the Apryse Web SDK and on your servers with the Apryse Server SDK. Sanitization runs only on the Server SDK. Sanitization is in the base package, and Redaction needs an add-on license on either surface.
A regulated workflow in financial services, healthcare, government or legal licenses the add-on on top of the base package. Read more on enterprise-grade redaction.
For server-side builds, follow server-side redaction in C# or server-side redaction in Java. The get-started guides are C# on .NET Framework and Java.
When You Need Both
Most regulated workflows need both operations before a document leaves your system. Redaction handles what a reviewer sees. Sanitization handles what a script can pull from the file. Skip either one and the gap stays open: a redacted file still carries its metadata, and a sanitized file still shows every sensitive line.
Your app decides when a document is ready for release. The compliance redaction process covers the verify and release steps. For volume, redacting documents in bulk means your code owns the loop. The Server SDK provides no work queue, job scheduler or batch orchestration.
What is Still Extractable if You Only Redact
Redaction clears the marked regions and nothing else. Metadata, XFA, XMP, embedded scripts, form data and hidden layers stay in the file. A reviewer sees a clean page, and a program reading the file still reads those structures. Earlier incremental saves also stay in the file, so a prior version of the redacted content can remain.
That matters when your pipeline extracts file-level data before sending a document to a model. Redaction alone leaves that data in reach. See PII removal before AI processing for that pipeline.
Redaction is Not Encryption Either
Encryption and permission controls restrict access to content that is still in the file. Redaction removes the content. If a recipient must never read something, access control is not enough. Encryption is a separate capability from both operations on this page.
