Qvault: redacting legal documents with AI that never leaves your computer
Every week, law firms send out documents that must not carry personal data: court filings, discovery productions, documents shared with the other side, data subject requests. Somebody has to find every name, ID number, bank account and address, black it out, and make sure it is really gone.
The usual options are not great. Doing it by hand is slow and error-prone. Cloud redaction tools mean uploading the very documents you are trying to protect to someone else's servers. And a black box drawn over text in a PDF often leaves the text underneath, ready to be copied out.
So I built Qvault: a free, open-source desktop app that finds personal data in PDFs, Word files and scanned pages, lets a person review every finding, and exports redacted copies in which the redacted text is really gone. Everything, including the AI, runs on your own computer.
What Qvault does
Qvault takes a document in, suggests what to redact, and gives you back a clean copy you can send. Along the way:
- Reads PDFs, Word files and scans. Text PDFs and DOCX are read directly. Scanned PDFs and PNG, JPG or TIFF images go through on-device OCR.
- Finds personal data in three layers. Patterns for emails, phone numbers, cards, IBANs and national IDs (US, EU, Brazil, Germany and more); rules for names, companies and addresses; and an optional local AI model that catches what rules miss.
- Keeps a person in charge. Every finding goes to review with its confidence and which layer found it. Nothing is redacted automatically, and you can add redactions by hand.
- Groups people and companies across documents. “Maria Silva”, “M. Silva” and “Ms. Silva” become one entity. If a new document mentions someone you redacted before and the detectors missed them, Qvault suggests it.
- Learns from your decisions. Things you rejected before are marked and sorted last. A “Not personal data” list, filled only when you choose, stops recurring false alarms, and it can be shared within a firm.
- Exports copies that are checked. Redacted PDF pages are turned into images with the boxes burned in, and metadata is stripped. Word files are redacted everywhere text hides: headers, footers, footnotes, comments and tracked changes. Then every export is read back, and if any approved text survives, the file is deleted and the export refused.
It runs on macOS, Windows and Linux, in English, Spanish and Portuguese. It is free and MIT-licensed, with no account, no licence key and no telemetry.
How it works
The three detection layers each catch different things: patterns are exact, rules know legal phrasing like “represented by”, and the AI catches names and details that follow no pattern. If no AI model is installed, the first two layers still run. Whatever they find, a person decides.
Why everything stays on your computer
A redaction tool that uploads your documents defeats its own purpose. So in Qvault no document, extracted text or finding ever leaves the machine. There is no cloud service behind it.
The AI runs through QVAC, Tether's open-source SDK for local AI. Qvault bundles it as a small helper process that talks to the app only through standard input and output. It opens no network sockets, which I check with tests on every build. It only loads model files from disk, and it refuses URLs and peer-to-peer model registries.
The only time Qvault touches the network is when you click Download on a model. It shows the size and the source first, downloads from a pinned Hugging Face revision over HTTPS, and checks the SHA-256 before using the file. Every model can also be imported from a file, so a machine that never goes online gets every feature. And if no model is installed at all, Qvault still works with its pattern and rule layers.
Measured, not guessed
It is easy to add AI to a product and assume it helps. I wanted numbers instead. So Qvault has a test set of 16 legal documents in English, Spanish and Portuguese, with 461 hand-labelled pieces of personal data, and some documents kept aside that are never used for tuning. Every change to detection is scored against it, and the rule-based layers are re-checked on every commit.
Those numbers decided the AI model. I first used Qwen3-1.7B, a small general language model. Then OpenAI released Privacy Filter, an open model built just for finding personal data. Measured on the same set, together with Qvault's rule layers:
| AI detector | Found | Held-out documents | False suggestions | Time per page |
|---|---|---|---|---|
| None (rules only) | 83% | 67% | 0 | instant |
| Qwen3-1.7B | 93% | 85% | 8 | 6.4 s (with GPU) |
| Privacy Filter (now the default) | 96% | 88% | 5 | 0.2 s (CPU only) |
| Privacy Filter + Qwen3 (“thorough” option) | 98.5% | 100% | 13 | 6.6 s |
Privacy Filter found more, raised fewer false alarms, and runs about 30 times faster without needing a graphics card. So it became the default, and Qwen3 stays as an optional thorough pass.
The numbers also stopped things. I built local fine-tuning so the model could learn from each user's reviews. Measured, it made results worse: one person's review history is far too small to train on. I dropped it and shipped something simpler that does work, the rejected-before marks and the “Not personal data” list. Checking instead of assuming also caught a serious bug early: the original PDF and Word export left redacted text recoverable. That is why every export is now read back and checked.
What it does not do
Redaction is high-stakes, so the limits matter as much as the features:
- It does not find everything. No detector does. The test set is small and synthetic, and real documents will score differently. That is why review is mandatory and not a setting.
- It does not decide for you. Qvault suggests; a person approves. Its learning only reorders and marks findings, and nothing is hidden or skipped without your explicit choice.
- It does not encrypt its own storage. Documents and review history sit in the app's data folder. Use your operating system's disk encryption (FileVault, BitLocker or LUKS).
- Redacted PDF pages become images. That is the price of making sure nothing hides under the black boxes.
- AI and OCR are desktop only. The models need a laptop or desktop; mobile keeps the pattern and rule layers.
Try it
Qvault is free and open source. Download it, read how it works, or look at the code:
- Download the latest release for macOS, Windows or Linux
- How Qvault works and setting up the AI models
- Source code and test set on GitHub
If you work with legal documents, I would love to hear where it helps and where it falls short. Real-world feedback is the next thing Qvault needs most.
Qvault stands on open work by others: QVAC by Tether, OpenAI Privacy Filter, Qwen3, EasyOCR and CRAFT for OCR, and Nomic Embed. Thank you to all of them.