v0.4.0-rc

Drag in a document, review what Sanctum found, export a clean copy.
Everything runs on your machine — no uploads, no network calls.

Sanctum Desktop is a local-first PII anonymization tool for legal and
consulting work. It renders your .docx as-is, highlights detected
personal data inline, and lets you accept or reject each one from the
keyboard before writing the anonymized file.

Unsigned build. Not code-signed or notarized yet, so your OS
will object. On macOS (Apple Silicon only):
xattr -d com.apple.quarantine "/Applications/Sanctum Desktop.app"
— note there is no -r, which fails on macOS 15+ because App
Management protects an installed app's contents. Or skip the
terminal: Open Anyway in System Settings > Privacy & Security.
On Windows (x64), SmartScreen says "Windows protected your PC":
click More info, then Run anyway. It installs for your
user only, no admin rights needed. Managed work PCs may block
unsigned installers outright.
On Linux, chmod +x the AppImage.

Backend: sanctum bdb5f07a73d0

v0.3.0-rc

Drag in a document, review what Sanctum found, export a clean copy.
Everything runs on your machine — no uploads, no network calls.

Sanctum Desktop is a local-first PII anonymization tool for legal and
consulting work. It renders your .docx as-is, highlights detected
personal data inline, and lets you accept or reject each one from the
keyboard before writing the anonymized file.

Unsigned build. Not code-signed or notarized yet, so your OS
will object. On macOS (Apple Silicon only):
xattr -d com.apple.quarantine "/Applications/Sanctum Desktop.app"
— note there is no -r, which fails on macOS 15+ because App
Management protects an installed app's contents. Or skip the
terminal: Open Anyway in System Settings > Privacy & Security.
On Linux, chmod +x the AppImage. No Windows build yet.

Backend: sanctum 2d574a4c8cec

v0.2.0-rc.1

Drag in a document, review what Sanctum found, export a clean copy.
Everything runs on your machine — no uploads, no network calls.

Sanctum Desktop is a local-first PII anonymization tool for legal and
consulting work. It now reviews Word (.docx), PowerPoint (.pptx) and
PDF files: it shows your document, highlights the personal data it
found, and lets you redact or keep each finding before it writes a
redacted copy. Your original is never changed.

Unsigned build. Not code-signed or notarized yet, so your OS
will object. On macOS (Apple Silicon only):
xattr -d com.apple.quarantine "/Applications/Sanctum Desktop.app"
— note there is no -r, which fails on macOS 15+ because App
Management protects an installed app's contents. Or skip the
terminal: Open Anyway in System Settings > Privacy & Security.
On Linux, chmod +x the AppImage. No Windows build yet.

New in 0.2.0-rc.1

• A new design. A sidebar with your findings, the document in the
  middle, and a details panel on the right. Press ⌘K for a command
  palette. Act on many findings at once ("Redact all People", or
  Shift+A / Shift+R). Findings use plain names ("People", "Email
  addresses") and Settings now open inside the app.
• A proper Mac menu bar. ⌘O open, ⌘W close, ⌘S save the redacted
  copy, ⌘, Settings, ⌘K command palette, ⌘Z undo (⇧⌘Z redoes typing
  in text fields only, not review decisions).
• PowerPoint review. See each slide, including speaker notes and
  picture descriptions (alt text), with findings grouped by slide.
• PDF review. See the real pages, with zoom and page thumbnails. In
  the redacted copy, pages with a redaction are turned into images;
  every other page is left untouched.
• Names broken up by formatting or line breaks (for example a name
  half in bold in Word, or split over two lines in a PDF) are now found
  and redacted as one finding.
• Email addresses on internal domains (.local, .internal, .corp)
  are now detected.
• A check before every save. After writing the redacted copy,
  Sanctum reads it back. If anything you chose to redact is still in
  there, the save is refused and a sheet lists what is left, with a
  Redact these too button. If a value sits somewhere Sanctum can't
  reach, the sheet tells you so.
• Hidden data is removed from Word and PowerPoint copies: author,
  last-modified-by, title and other document properties, company and
  manager, comments, and the preview thumbnail. Word tracked changes
  are accepted. Field codes and picture descriptions that mention a
  redacted value are cleared, and links on redacted text are removed.
• Word headers and footers are now reviewed and redacted.
• Text you mark by hand is now replaced with [REDACTED] instead of
  <USER_ADDED>.

Fixed

• Acting on many findings at once no longer loses some of your
  decisions.
• No more error messages from the Recent list when the app starts.
• Fonts load without security warnings.
• The Redact / Keep original buttons now show the decision you made.
• In a small window, with the sidebar collapsed, the findings list is
  still available as an overlay.

Known issues

• The Standard detection model misses some names (for example some
  non-English names, or names in tables). The save check catches what is
  left over and offers Redact these too.
• Sanctum sometimes flags things that aren't personal data (for example
  "the Confidential Information" tagged as an organisation). Choose
  Keep for those, otherwise the save check will ask you to redact
  the other places the same words appear.
• Not scanned or redacted: Word footnotes, endnotes and text boxes;
  PowerPoint charts, SmartArt, embedded objects, and text on slide
  masters or layouts; PDF text drawn as shapes or inside images; scanned
  PDFs (there is no OCR). If a value you redacted also appears in one of
  these places, the save is refused and the sheet tells you the value
  appears where Sanctum can't redact it, so you need to edit the
  original document and open it again.
• Word fields whose visible text isn't redacted keep their code. A
  table of contents or index with a redacted entry becomes plain text.
• PDF: redacted pages become images at 200 dpi, so they lose links,
  form fields and accessibility tags (text on untouched pages stays
  searchable). Replacement text is always in Helvetica. Rotated text
  close to a redaction may be erased.
• The PowerPoint view is approximate: no theme colours, gradients or
  rotation, and charts and SmartArt show as placeholders. Slide
  thumbnails show the original text.
• Findings in Word headers and footers appear in the findings list but
  are not highlighted on the page.
• PDF page thumbnails and PowerPoint slide thumbnails are hidden when
  the window is narrower than 1200 pixels.
• Very long PDFs viewed at high zoom use a lot of memory.
• The sensitivity presets (Catch more / Balanced / Fewer false alarms)
  are not tuned yet.
• A Word review left open from rc.3 may be refused if a name also
  appears in a header. Reopen the file to review it again.
• Keeping a name that was split across formatting or lines also keeps
  its parts (for example "Martin") out of the save check for the whole
  document.

v0.1.0-rc.3

Drag in a document, review what Sanctum found, export a clean copy.
Everything runs on your machine — no uploads, no network calls.

Sanctum Desktop is a local-first PII anonymization tool for legal and
consulting work. It renders your .docx as-is, highlights detected
personal data inline, and lets you accept or reject each one from the
keyboard before writing the anonymized file.

Unsigned build. Not code-signed or notarized yet, so your OS
will object. On macOS (Apple Silicon only):
xattr -dr com.apple.quarantine "/Applications/Sanctum Desktop.app".
On Linux, chmod +x the AppImage. No Windows build yet.

Backend: sanctum e662e03c9d58