For law firms and notaries
Black is not deletion.
The bar is a rectangle on top of the text. The text is still in the file — selectable, copyable, searchable. Whoever releases the file like this releases the plain text with it.
NewNot just personal data: for antitrust and competition proceedings, an optional profile suggests trade secrets for review →The party Max Mustermann, residing at Beispielweg 12, 20095 Hamburg, holds account DE00 0000 0000 0000 0000 00 with Beispielbank. According to the certificate dated 12 March 2026, there is a diagnosis F00.0.
Fictitious example. All details are invented; the account number is not a valid bank account.
The workflow · 55 seconds
See lumen.mask at work.
From upload and review of each finding to the redacted document: this short video shows the intended workflow from start to finish.
The problem
Select. Copy. Paste. The name is back.
When you place a black rectangle over a name in a PDF viewer or in Word, the name has not disappeared. It is still in the text layer of the file. Every full-text search finds it, every copy operation brings it back — on the other side's screen, a single keystroke is enough.
The rectangle belongs to the presentation. The name belongs to the content. What is released is the content.
This is not a failure of your diligence.
A rectangle tool draws a rectangle. It does not remove text — it was never built for that. That a black bar deletes something is the most natural assumption in the world. It just happens to be wrong. The same applies to text coloured white and to rectangles on image layers.
Don't take our word for it.
Check it on a file your firm has already released. You need two minutes and no appointment.
- 1
Open a redacted PDF file from your records.
- 2
Select all and copy: Ctrl + A Ctrl + C
- 3
Paste into an empty text document: Ctrl + V
Even faster: Search with Ctrl + F for a name that should be redacted. If the search finds it, it is still there.
If nothing appears, your redaction was fine. Then you have lost two minutes and gained one less worry.
§ 203 of the German Criminal Code leaves no discretion here.
Whether all elements of this provision are met in a given case is not decided by the firm. Someone else decides — in proceedings that are themselves already the damage. The professional-law side reaches you earlier anyway: § 43a (2) BRAO, § 18 BNotO — and the notification duty under Art. 33 GDPR runs in hours from knowledge, not in weeks.
The uncomfortable question is not whether this is true. It is how many files your firm has released like this in the past five years.
Where this happens in daily practice
Four places where your firm redacts
Redaction rarely happens because someone planned it. It happens because a deadline is running.
File inspection
The file goes to the opposing party or to the court. Third-party data has to come out: witnesses, neighbours, employees, bank details, health information.
Exhibits to a brief
A bank statement, a medical report, a payslip. The brief has been reviewed. The exhibit was scanned.
Access requests under Art. 15 GDPR
The data subject is entitled to their data — not to the data of the three other people on the same page. The deadline is one month.
Release to third parties
To the insurer, the expert, the succeeding firm. The file goes along — and with it everything that has found its way in over five years.
Who redacts this today? In most firms, whoever happens to have time.
Who signs? The professional.
And when someone asks three months later which passage was redacted for which reason — who answers that, and based on what?
You are a notary's office? Same process. What is called a file here is your deed collection: copies, lists of parties, exhibits.
And if your bar holds?
Then someone at your firm works diligently. That leaves the second question: Can you show it? Who redacted, who cross-checked, which passage on which page, when. You have long practised the four-eyes principle — you just cannot prove it. It lives in a shout across the corridor.
How it works
Five steps. A person does two of them.
One thing changes in your process: instead of marking in the PDF viewer, you upload the file and work through a list. The rest is your existing routine. No form before, no sales call after.
Upload
PDF, Word, Excel or image file — plus two details: what the redaction is for and how confidential the file is.
The system marks
Thirteen categories of personal data, every finding with a detection confidence: red, yellow or green. Once detected, the same detail is suggested at every further occurrence in the document. As biometric features the system detects facial photos, signatures and stamps — other biometric data it does not; image areas you redact with a rectangle.
You decide
HumanFinding by finding: redact or not. Leaving a red finding in place requires a written reason. Leaving a yellow or green one open is itself the decision: it will not be redacted.
The approval
HumanBefore approval you see the complete list of findings and what happens to each — and confirm the redacted view (final check). If text recognition fails on a page, that too must be explicitly confirmed.
The redacted document
In the format of the source file, with cleaned metadata — and proof of which passage on which page was redacted, along with a log of who decided what and when.
Three roles — anyone without one sees nothing
Editor uploads and marks — sees only their own documents. Reviewer decides findings and approves. Administration manages access and sees the log. That is the default, not something anyone has to set up.
The work happens at a desk: the review screen is built for a large monitor. Review needs space.
Four-eyes approval
A second person — automatic for Art. 9 data.
For health, origin, religious and biometric data (Art. 9 GDPR) and for strictly confidential files, lumen.mask switches on the second approval by default itself. Submission is the first pair of eyes; an independent second person reviews and approves. Your firm can make this binding for all files.
- As long as a red finding is undecided, the system does not release the document.
- If four-eyes approval is active, the server rejects it when the same person uploaded or decided findings — including in batch.
- Only administration can override, with a written reason — and that reason is in the log.
Not just personal data
Antitrust proceedings: trade secrets are suggested for review, too.
Where file inspection meets competitors, the risk is not names but numbers. An optional analysis profile for antitrust and competition proceedings suggests trade secrets for review — prices, margins, market shares, supply volumes, customer and supplier lists, among others.
- Exportable confidentiality register — with a reason for every finding.
- Parties to the proceedings can be named and are not suggested as customers to redact.
- Here too: the profile suggests, it does not decide — the review stays with you.
- Margin“EBIT margin segment north: 18.4 %”p. 12
- Customer list“Top customers: Muster GmbH, Beispiel AG”p. 27
- Market share“DACH share 2025: 31 %”p. 33
- Party“Affected company” — named, no redaction suggestionp. 2
Fictitious example of a register excerpt. All details are invented.
Evidence
Three things we can prove
You examine evidence for a living. So here is only what we have evidence for. You can forward this section: lumen-cloud.de/en/mask#belege
- 01
Irreversible — and proven
On PDF export, every page is converted into pixels and the bar is burnt into them. The result no longer has a text layer: no selecting, no copying, no full-text search. The self-test from above comes up empty against our output — proven with an automated test on the final exported PDF.
- 02
A second person where it matters
For Art. 9 data and strictly confidential files, the second approval switches on by itself. The server rejects approval by the same person — including in batch. Overriding requires a written reason, and that reason is in the log.
- 03
Verifiable, finding by finding
After export, we prove finding by finding which passage on which page was redacted. Anything that could not be cleanly redacted is flagged as a warning. The log is secured append-only: entries are only added, and any subsequent change is detectable via a checksum chain.
And one thing we do not claim
Detection is a suggestion, not a guarantee. No system of this kind reliably finds every personal detail. That is why human review is not an intermediate step to be rationalised away — it is the point where the process holds.
What we specify: As biometric features, the system detects facial photos, signatures and stamps — other biometric data it does not. Headers, footers and footnotes of Word documents are currently not searched. There is no interface to your practice-management software, and we do not claim one.
No external AI. All AI models — text recognition, name recognition, pattern recognition, visual recognition — run on our own infrastructure in our own containers. We present you with a data processing agreement under Art. 28 GDPR before you upload the first file.
- 0
- Text layers remain in the redacted PDF — no selecting, no copying, no full-text search
- 13
- Categories of personal data the AI detects — including facial photos, signatures and stamps; other biometric data it does not
- Art. 9
- Health, religion, origin, biometrics: the second approval switches on by default
- 3
- Roles: editor, reviewer, administration. Anyone without one sees nothing.
Common questions
What law firms ask us
We work with RA-MICRO.
lumen.mask does not replace your practice-management software and does not access it. There is no interface, and we do not claim one. You export the document as you do today, redact it here and put the redacted version back into the file. It is a specialist tool for one task, not a second system for everything.Where does our data live?
No external AI, no cloud OCR. All AI models — text recognition, name recognition, pattern recognition, visual recognition — run on our own infrastructure in our own containers. We present you with a data processing agreement under Art. 28 GDPR before you upload the first file.Who is liable if something is missed?
You are. Just as today. The system suggests, it does not decide. What changes: there is a log proving who decided what and when. That is the difference between a mistake and an unexplainable mistake.What does it cost?
lumen.mask currently runs as a pilot programme with selected firms; we do not have a published pricing model. In the appointment we give you a concrete figure for your firm's size before anything is set up.Some of our files are scanned.
Scanned and mixed files are processed page by page: digital pages via the text, scanned pages via text recognition. Where text recognition fails, this is flagged — and must be explicitly confirmed before approval. We do not quote a reliability figure; how well it works on your files is something we show you on your own example. Bring such a file with you.We work a lot with Word.
You can upload and redact Word and Excel files. However, our proof on the finished document is for PDF — the format in which files are usually released. And as long as a known issue is open, we say it: the system currently does not search the headers, footers and footnotes of Word files. In a brief, that is often where the case caption sits. For Word we therefore make no promise today.Who needs training?
The secretariat uploads. The reviewing person works through a list: arrow keys to move, one key to redact, one to leave in place — with a mandatory reason for red findings. That is the entire operation. The onboarding is the demonstration.
The question from our letter
How many hours does your firm spend redacting each month — and how many of them would stand up to scrutiny?
We don't know. Nobody has ever measured it, and that is why we will not promise you any savings either. Tell us your number. In return, we show you the process on a document you know: thirty minutes, screen share, no sales call afterwards.
lumen.mask currently runs as a pilot with selected firms. If your firm redacts regularly, you will see it on a document you know.
Prefer to talk directly: +49 40 239 366 870 · kontakt@lumen-cloud.de
If you call us yourself, you will not experience a sales call.