A local model and deterministic rails find the names, numbers and identifying details, on hardware you own — 94.97% measured on documents it had never seen. You review everything; nothing exports without your yes.
Free · open source (Apache-2.0) · no account, no server, no telemetry
The core claim, live
In the December 2025 release of the Epstein files, "redacted" names were one copy-paste away — the ink covered the text without removing it. Both documents below are live.
The same trick journalists used on the released files. It works on the left document. It has nothing to work on in the right one.
Simpler Redact never draws boxes over your document. Each detail it finds is deleted from the text and substituted with a placeholder, and the export is a new file rebuilt from the cleaned text. A name gets the same tag everywhere it appears in the document, so the document stays readable — for you, and for the AI you hand it to. If one person is written two ways, say “John Smith” and a bare “Smith”, you mark them as the same in review and they share one tag. The map from tags back to names is a separate file that never exports with the document unless you explicitly say so.
Why local isn't a feature toggle
"AI" has meant "send it to a data center" for so long that local sounds like a setting. It isn't — it's the direction of travel reversed. Your documents don't go to the AI. The AI comes to you.
It's the same architecture the AI labs run — a model behind a server — except the server is your laptop and its only client is you. That's why there are no page caps, no monthly allowance, no metering: nobody's hardware is doing you a favor. The model itself is Google's Gemma 4 E2B exactly as Google shipped it — tuned by Google, quantized by Google, modified by no one — and the app proves it on your machine, hashing the weights against the published pin before they ever run.
The corridor
One corridor, no suite, no workflow product. It does one job.
A contract, a letter, an intake form. It never uploads — there is nowhere to upload to.
A wide sweep finds identities; code removes every copy document-wide; a second pass re-reads the result hunting anything left behind.
Everything found, in one table — a guided pass walks you through the uncertain ones, keyboard-first. Nothing exports without your yes.
The redacted copy — plus, separately and only if you ask, the key that maps tags back to names.
The app — v0.1.0
If a run is incomplete, the export is held. If a span can't be verified, it's refused. The last reviewer is you — by design, not as a disclaimer.
These are screenshots of the released build. They come from the real application running the real engine — no mockups. v0.1.0 is a first release and still changing; download it, or run the command-line tool from source.
Review. Original and redacted side by side, every finding highlighted in place — and a guided pass walks the shaky ones one at a time. The finish button stays locked until you've decided each.
Export. The honest funnel, verify-by-extraction plus a partial-name check, a receipt for your records — then copy the redacted text straight into the AI you use, or save it as a file. The original is never touched.
Measured, published, reproducible
Every accuracy number in this industry is a sentence you're asked to believe. Ours is a command you can run. The corpus, the ground truth, and every measured run live in the repository — the exhibits below link to the raw files, and the full methodology, per-class results and leak ledger have their own page.
EXHIBIT A
118 real public documents — SEC filings, merger and employment agreements, court opinions, earnings-call transcripts, OCR'd 1960s town reports, a Singapore judgment — each hand-annotated with ground truth before any run. The annotation itself is measured: blind second-pass agreement 0.925; the medical gold standard's human-human bar is 0.927.
bench/ in the repoEXHIBIT B
Every measurement campaign is committed with its methodology, its results JSON, and its failures — including the configurations that leaked, and what changed because of them.
the full battery recordEXHIBIT C
Every defect ever measured is pinned as a test that fails the build if it regresses. The benchmark isn't marketing — it's the thing that refuses the release.
test/ in the repo| Measurement | Corpus | Result |
|---|---|---|
| Engine A alone — the model span pass, before the rails | real in-sample corpus, 207 occurrences | 93.7% |
| + the deterministic rails | same corpus | 99.5% — 5 of 6 documents perfect |
| Full two-engine pipeline — documents it was tuned on | 8 SEC filings — the ratchet floor | 100.00% — 243/243 entities |
| Full pipeline — documents it had never seen | 18 hostile documents, ~125k words, pre-registered | 94.97% of entities · 98.2% of occurrences |
| The other direction — what a frontier AI still extracts from those same redacted exports | same 18 documents · 90 blind original-vs-masked questions | 0.983 substance-equivalence · 0 contradictions |
| The whole v1.0 battery | 118 real documents | 95.82% — 3,487/3,639 entities |
| Baseline — Microsoft Presidio as shipped, same documents, same metric | 90 walk-forward documents | 43.10% |
Measured 2026-07-19 → 2026-07-21 — pipeline and battery rows on the
release engine cb3627c; the two Engine-A arc rows are the founding engine
(54112a2) they improved on.
Both rows are published — the flattering one (100.00% on documents it was tuned on) and the
honest one (94.97% on documents it had never seen, published as drawn under a pre-registration
rule). A vendor that shows you only one number is showing you the wrong one.
Want the methodology, per-class breakdowns and every named miss?
The nerd page.
The whole bench — corpus, ground truth, runner, floor — ships in the tree. Green means every measured lesson still holds; a single core leak exits red.
git clone https://github.com/Simpler-Systems/simpler-redact cd simpler-redact && npm install npm run verify # the gate: every pinned test npm run bench:all # the ratchet: the full corpus, zero-core-leak floor
Get it
The desktop app is here, and so are the engine, the rails, the full benchmark and the command-line tool. v0.1.0 ships without a publisher signature — the certificate is a company-registry timing problem rather than a software one, and we would rather hand you a checksum and say so than hold the release and say nothing.
Needs Node 20+ and a local llama-server holding the pinned model. Nothing
here talks to a network except the one time you fetch the weights yourself.
git clone https://github.com/Simpler-Systems/simpler-redact cd simpler-redact && npm install node scripts/verify-model.mjs # confirms your GGUF matches Google's published weights node bin/red.mjs contract.pdf # → contract.redacted.txt + the entity table
The weights are not in this repository and
never will be — they are Google's, ~3 GB, under the
Gemma
Terms of Use, and gated behind a licence click on Hugging Face. If you already have
gemma-4-E2B_q4_0-it.gguf for LM Studio or Ollama, point us at that copy — the
SHA-256 decides, not the filename, so one download serves every tool that pins these
weights.
Every figure on this site recomputes
offline from committed files: npm run audit re-derives them and exits
non-zero on drift — no model required. npm run verify runs the gate
(70 tests, no install needed). npm run bench:all re-runs the full ratchet against your own
local model.
v0.1.0 is out, for Windows x64, unsigned, with its SHA-256 printed beside the button above. What is still missing is distribution polish rather than software: a code-signing certificate, and a mirror for the weights. Both arrive in a later version, and we are not naming a date we cannot keep.
The brief for IT & InfoSec reviewers answers the standard software-review questions — architecture, network behaviour, what it never does, and how to verify each claim independently. Written to be forwarded as-is.
Audit us
The privacy claim is testable. The first check takes five minutes and no expertise at all.
Turn off Wi-Fi, redact a document. Everything works, because nothing was ever remote.
Run a free network monitor (Wireshark, Little Snitch) during a redaction. From the app itself: zero. You will also see the Microsoft Edge WebView2 runtime that draws the window call home once at launch — not ours, not suppressible, and no document content reaches it. The IT brief gives the whole story and the firewall rule that stops it.
It's open source. Grep for a network call — there isn't one outside the local model on your own machine.
The egress pill in the corner reads "0 outbound connections from this app" and opens the full network record, including the WebView2 row. It is a statement, not a live capture, and it says so — the two checks above are the ones that settle it.
Questions
A BAA covers vendors who receive your data. This is local software — your documents never reach us, and there's no server that could receive them. Not legal advice; confirm with your counsel.
PDF, Word (.docx) and plain text. Scanned or image-only pages need OCR, which isn't included yet — we'd rather tell you that plainly than silently guess at a page. Exports are clean text files, rebuilt from the redacted text — never your original with boxes drawn on it.
Nothing. Apache-2.0 open source, no account, no tiers. If you want document work handled end-to-end on the AI subscription you already pay for, that's our sibling product — simpler.asia.
Simpler Redact