Redwood · PII redaction for public records

Redact what must be redacted. Release everything else.

Redwood finds the personal information in case files, correspondence, and records requests — and leaves the public record intact. It runs on your own servers, on CPU, and never sends a document to the cloud.

92% fewer over-redactions than the model it's built on — with nothing missed on the held-out set.¹²

Request a pilot Read the evidence

Ten PII typesOn your serversFull audit log

Response to records requestResponse to records request · Redacted copy

Re: Case No. [detected: case number] FAM-2019-204418 · [detected: date] March 4, 2026 detected · released by policy

Dear Ms. [detected: person name] Dana Whitfield,

We have located the records you requested concerning [detected: organization] Harbor Point Property Management. The subject, [detected: person name] Marcus T. Ellery (DOB [detected: date of birth] 06/12/1981, SSN [detected: social security number] 000-45-6789), was contacted at [detected: phone number] (503) 555-0142 and [detected: email address] m.ellery@example.net. Copies were mailed to [detected: full address] 1420 Larkspur Ave, Suite 3B, Portland, OR 97205.

The remaining pages are released in full under the Freedom of Information Act not PII · released.

cc: [detected: person name] Marcus T. Ellery

Page 1 of 2

Found on this page

Person3
Address1
Organization1
SSN1
Phone1
Email1
Credit card–
Date of birth1
Date1
Case number1

99.97%
recall on 3,436 PII spans across 250 evaluation pages²
One miss — shared by every model tested
92% fewer
over-redactions than the open model it's built on¹
Same pages, same pipeline, same threshold
10
PII types, from names to case numbers³
Names, addresses, organizations, SSNs, phones, emails, credit cards, dates, dates of birth, case numbers
0
documents sent to the cloud⁴
In-process, on CPU, no network calls

Every record has more PII than you'd think.

Response to records requestResponse to records request · Redacted copy

Re: Case No. [redacted: case number] FAM-2019-204418 · [detected, released by policy: date] March 4, 2026 detected · released by policy

Dear Ms. [redacted: person name] Dana Whitfield,

We have located the records you requested concerning [redacted: organization] Harbor Point Property Management. The subject, [redacted: person name] Marcus T. Ellery (DOB [redacted: date of birth] 06/12/1981, SSN [redacted: social security number] 000-45-6789), was contacted at [redacted: phone number] (503) 555-0142 and [redacted: email address] m.ellery@example.net. Copies were mailed to [redacted: full address] 1420 Larkspur Ave, Suite 3B, Portland, OR 97205.

The remaining pages are released in full under the Freedom of Information Act not PII · released.

cc: [redacted: person name] Marcus T. Ellery

Page 1 of 2

Ten PII types
Names to case numbers, one pass.
Nothing missed
1,702 of 1,702 PII spans found on the held-out pages.
92% fewer over-redactions
Than the open model it's built on.

audit.json · detected 11 · redacted 10 · released_by_policy 1

modelperson nameDana Whitfield1.000
regexfull address1420 Larkspur Ave, Suite 3B, Portland, OR 972051.000
rescanperson nameMarcus T. Ellery · 2nd occurrence1.000
releaseddateMarch 4, 2026 · policy1.000

Request a pilot Read the evidence

Three layers. One audit trail.

A language model reads for meaning. A deterministic layer catches what has a fixed shape. A re-scan makes sure the fortieth mention of a name is treated like the first. Every span is logged with the layer that caught it.

01 · Model
Reads every chunk in context
A fine-tuned GLiNER2 model (mDeBERTa-v3 encoder) reads every 1,400-character chunk and labels the ten PII types the way a records officer would — by what the words mean, not just how they look.
02 · Deterministic
Catches fixed shapes, every time
Social Security numbers, US phone numbers, email addresses, docket numbers, and street addresses in standard US formats are matched by pattern, independent of model judgment. The exact formats are listed on the Evidence page.
03 · Re-scan
Finds every repeat
Any surface of four or more characters found once is found at every other exact, case-sensitive occurrence in the same text — the fortieth mention is redacted exactly like the first.
Audit log
A reason for every redaction
Each span is recorded with its label, confidence, position, and which layer caught it — and every span your policy released. The record your reviewers and your counsel can stand behind.

Nothing leaves your environment.

Redaction happens where the records already live. The audit log it writes contains the redacted text itself — keep it under the same controls as the records.

Runs in-process, on CPU, on your servers
Redwood is a library your platform calls, not a service you send documents to. No GPU required; no separate host to accredit.
No network calls in the redaction path
The pipeline reads a local model directory and writes local files. It is verified by running it with networking disabled — nothing in the redaction path opens a connection.
Open lineage, synthetic training data
Built on an open model (Apache-2.0 per the model card shipped with revision c153999; named on the Evidence page). Trained only on synthetic documents; measured on a separate synthetic corpus never used for training. Designed to be deployed inside your existing accreditation boundary.

Prove it on your own records.

A pilot runs Redwood on a sample of your records, inside your environment, and returns the same scorecard we publish — recall and false positives, per PII type, on your documents.

Request a pilot Read the evidence

Or write to chancellorblanchard@gmail.com

Notes

False positives — spans redacted that the ground truth does not mark; a detection wider than the truth counts as correct — measured with the full pipeline (model + deterministic patterns + repeat re-scan) on the same pages at the same threshold (0.3). Held-out half: 160 with the open base model (fastino/gliner2-privacy-filter-PII-multi; Apache-2.0 per the model card shipped with revision c153999) → 16 with Redwood v3 (−90%). Both halves combined: 265 → 22 (−92%). Of the 22, 19 are agency sub-unit names in letterheads and 3 are dates of birth also tagged as dates — over-redacted text, not leaked text.↩a ↩b
Measured on a separate 250-page synthetic evaluation corpus built for the redaction platform Redwood is being integrated into — a different generator from our training data, never used for training, with 3,436 ground-truth PII spans across ten types, exact by construction. The pages were split once, by seeded random draw, into a 125-page tuning half and a 125-page held-out half that never influenced training data or settings. On the held-out half Redwood v3 found 1,702 of 1,702 spans (recall 100%). Across both halves it found 3,435 of 3,436 (99.97%); the single miss is one name in a signature block that every model we tested, including the unmodified base model, also misses. A span counts as found when detections of the same type cover at least half of its characters.↩a ↩b
Names, addresses, organizations, Social Security numbers, phone numbers, email addresses, credit card numbers, dates, dates of birth, case numbers.↩
Runs in-process on CPU inside your environment. The redaction pipeline makes no network calls: it reads a local model directory and writes local files.↩

Redact what must be redacted. Release everything else.

Measured results

Every record has more PII than you'd think.

Three layers. One audit trail.

Reads every chunk in context

Catches fixed shapes, every time

Finds every repeat

A reason for every redaction

Nothing leaves your environment.

Runs in-process, on CPU, on your servers

No network calls in the redaction path

Open lineage, synthetic training data

Prove it on your own records.