Applies to: All editions
Sanitization is policy-based
A PDF can contain visible page content plus metadata, identifiers, incremental revisions, annotations, form data, embedded files, actions, links, bookmarks, optional-content structures, and content that is not normally visible. PDFSanitize applies the removals selected by the current profile or custom policy; it does not treat every possible PDF object as unwanted by default.
Review the active profile before processing a document and select a stronger profile when the sharing risk requires it.
Source files are not overwritten
PDFSanitize creates a separate sanitized file beside the source. This design protects the original from accidental replacement, but it also means the sensitive source remains present on disk.
Do not share a file based only on a similar filename. Confirm that the file you distribute is the sanitized output and, for controlled workflows, match its SHA-256 fingerprint to the verification or report record.
Digital signatures
Any sanitization changes the PDF and invalidates an existing digital signature. PDFSanitize detects signed documents during analysis and displays a warning before sanitization. If signature validity must be preserved as evidence, retain the original signed PDF separately and treat the sanitized copy as a derived disclosure document.
Encrypted PDFs
Encrypted or password-protected PDFs are detected but cannot currently be sanitized. The document is marked as encrypted and sanitization skips it. Decrypt the document through an authorized workflow before adding the resulting unencrypted copy to a sanitization job.
Visible-content tradeoffs
Preserve Quality is intended to retain normal PDF text and vector content where the selected removals permit it. Removing hidden or completely off-page text can require reconstruction of affected pages.
Maximum Assurance reconstructs every page from rendered content. This provides stronger separation from original page-level objects but changes document characteristics: selectable source text, original vector objects, forms, hyperlinks, and digital signatures are not retained in their original form under the predefined Maximum Assurance profile.
Assurance boundaries
A successful PDFSanitize verification applies to the exact output file and the policy recorded for that sanitization. It does not prove that:
- Other copies, earlier exports, email attachments, cloud versions, backups, or document-management replicas were sanitized;
- Sensitive information was not already disclosed before sanitization;
- Every possible steganographic, visual, semantic, or format-specific concealment technique was detected;
- Visible page content is appropriate for disclosure; or
- The recipient’s PDF viewer will not infer links from visible URL text.
Use PDFSanitize as one control within an approved disclosure and review process, not as a replacement for content review, authorization, retention, or legal-hold requirements.