Four very different things get sold as redaction: a model you run, a cloud API you call, an SDK you build with, and a subscription you sign in to. They differ less in what they cover than in what you have to stand up before the first page is done, and where that page ends up.
The four categories, and what each one is really asking for
A model is weights. OpenAI publishes one for this job, and its repository documents the way in: install the package, then run the command line tool over a string or a file. The model card describes it as running in a web browser or on a laptop, and the repository defaults to running on a GPU with a flag to fall back to the processor. That is a real capability and a real project: someone has to own the environment, the runtime, and the interface the people doing the redacting will actually use.
A cloud API is a service you send documents to. Amazon Textract extracts printed text, handwriting, and data from documents and is billed per page against an AWS account. It reads pages well. Its product page documents no detection or redaction of personal information, so the part that decides what is sensitive is still yours to build.
An SDK is a toolkit for a product you are building. Apryse ships redaction inside a developer toolkit under a commercial licence, and Nutrient licences by platform, capability, and deployment model across on-premises, cloud, and hybrid. Both permanently remove content when told what to remove. Neither product page documents automatic detection of sensitive values as a built-in feature.
A subscription is the closest thing to PHI Mask. Redactable detects personal information automatically and permanently redacts it, reads scanned documents, and connects to the usual cloud drives. It is also an account, a monthly plan, and a document allowance per tier, with the file processed on the vendor's platform. Tonic sits one level up again as a platform that connects to your production databases and de-identifies structured and unstructured data, which is a data engineering programme rather than a thing you open before an appointment.
What each one asks for first
| Category | Example | Before the first page | Where the document goes | Finds the values |
|---|---|---|---|---|
| Model you run | OpenAI Privacy Filter | Install the package, provide a runtime, build an interface | Stays on the machine you ran it on | Yes, in text |
| Cloud API | Amazon Textract | An AWS account, credentials, and per-page billing | To the vendor's service | No detection of personal information documented |
| Developer SDK | Apryse, Nutrient | A licence and an application to embed it in | Wherever you deploy it | No automatic detection documented |
| Subscription | Redactable | An account and a plan with a document allowance | To the vendor's platform | Yes, automatically |
| Data platform | Tonic | A connection to your databases and a project to run it | Through the platform | Yes, at pipeline scale |
| Browser workspace | PHI Mask | Open a link | Stays in the tab you opened | Yes, in text, screenshots, and PDFs |
Most of them cannot see a screenshot
This is the divide that decides the day-to-day. The published detection model is a token classifier over written text: strong at what it does, and it takes a string. A screenshot of a chart view is not a string. A scanned referral letter is not a string either, and neither is the PDF a portal exports, until something reads the page and works out which words sit in which column.
Reading a page is the part that separates a demo from a working tool. Identifiers on a screenshot live in the window title, the patient banner, a browser tab, a sidebar list, a table cell, and the body of the note all at once, and a reader that flattens two columns into one line produces text where a name and the wrong date now sit together. PHI Mask reads the image itself and follows the layout it finds, then detects across the result, which is why a screenshot, a scan, and pasted text all go through one pass.
What a self-run model actually costs you
Running your own weights is the option that looks free and is not. You are taking on the environment, the hardware, the version, and the interface, and OpenAI's own model card is candid about the rest: it says plainly that the model is not an anonymization, compliance, or safety guarantee, and names under-detection of uncommon personal names, regional naming conventions, and initials among its failure modes, along with weaker performance outside English and outside the domains it was trained on.
That is an honest model card, and it describes the work a deployment still has to do. Someone has to give a clinician a screen, put the detections in front of them, let them change one, and hand back a document. That work is the product, and it is the part a set of weights does not come with.
Where PHI Mask fits
PHI Mask is the browser workspace row. You open a link, paste or drop the document, and the names, dates, chart and account numbers, phone numbers, and addresses come back marked for you to approve. There is no account for the first document, no licence to negotiate, no runtime to own, and no page allowance to watch. Detection results by document type are published on the benchmark, scored against a public corpus of authored documents.
The document stays in the tab. That is the difference from every hosted row above, and it is the one that matters when the file is a patient record: the question "did this leave the building" has the same answer before and after. It also means a covered copy stays useful, because masked values keep a reversible stand-in you can map back in one step once the reply comes in.
Review before sharing.
Start with text, a PDF, or a screenshot.
Sources and review notes
Every statement about another product above comes from that vendor's own current documentation, reviewed on the date shown at the top of this page: the OpenAI Privacy Filter model card and its repository, Amazon Textract, Apryse, Nutrient, Redactable and its pricing page, and Tonic. Where a page is silent on a capability, the table says so rather than guessing. Products change quickly in this category, which is why this comparison carries a recheck date.
Common questions
- Is there a free redaction tool that finds the sensitive information itself?
- PHI Mask does, in the browser, with no account for the first document. Among the paid alternatives, subscription platforms detect automatically on their own servers, while developer toolkits remove what you tell them to remove and leave the finding to you.
- Can I just run the open redaction model OpenAI published?
- You can, and it is a capable text model. Its repository is a command line tool and library you install and host, its card says it is not an anonymization, compliance, or safety guarantee, and it takes written text rather than images or PDFs.
- Do any of them work on screenshots?
- That is the sharpest divide in the category. Text-only detection cannot see a picture of a screen at all, and page-reading services do not necessarily detect what is sensitive. PHI Mask reads the image and detects across the result in one pass.
- Does my document leave my machine?
- With a subscription platform or a cloud API it goes to the vendor. With a self-hosted model or an embedded toolkit it goes wherever you deployed it. With PHI Mask it stays in the browser tab you opened.
- What does an SDK give me that a workspace does not?
- A place to put redaction inside software you are already building, under a commercial licence. If you want to redact a document today rather than ship a feature, that is a project where a workspace is a link.