Lindoby Petrarch
Sign in

What happens to each format

Read from the engine on each request, not written down here.

Formats
26
Extensions
37
Caveats declared
63
What this deployment has installed
7 of 10

The table below describes what the software does. This is whether the parts it needs are actually on the machine your files would be sent to - which is a different question, and the two can disagree. Anything missing here is ours to install, not yours: you have no access to this host, so there is nothing for you to do about it except know before you send us a corpus that depends on it.

Deterministic de-identification
Installed
Python standard library only
Image libraries (Pillow, NumPy)
Installed
installed
exiftool
Installed
13.25
tesseract OCR
Installed
tesseract 5.5.0
Pre-2007 Word converter (.doc)
Installed
LibreOffice 25.2.3.2 520(Build:2) (LibreOffice; the cloud engine's convert-on-ingest)
Image de-identification component
Installed
ready
Second-opinion verification component
Installed
ready
Local model runtime
Not installed
not found on PATH
Needs a program that serves a model on your own machine
Vision model (mistral-small3.2:24b)
Not installed
no local model runtime answering on http://127.0.0.1:11434 ([Errno 111] Connection refused)
Needs about 6 GB of model weights, stored on this machine. Without it, text burned into pictures is not read and documents containing one are withheld rather than handed over unchecked
Text model (qwen3.6:35b-a3b-q4_K_M)
Not installed
no local model runtime answering on http://127.0.0.1:11434 ([Errno 111] Connection refused)
Needs about 20 GB of model weights. Without it the setup interview and the verification pass fall back to a smaller model that misses names, and the run report says which model was used
Office documents
4 formats
.docx
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Footnotes
Notes are handled as body text rather than skipped as furniture.
Headers and footers
The running strip on every page, which is where a client name usually repeats.
Link text
The words a reader sees where a link sits.
Link targets
The address behind the link, where an account id or a mailbox often hides.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Table cells
Text inside tables is reached cell by cell, not only the prose around them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Tracked changes
Text held in insertions and deletions, which survives accepting the changes.
What it will not do
Tracked-change text (insertions and deletions) is replaced but the revision timestamps stay, so the delivered file still records when each change was made.
Embedded images get their EXIF/XMP metadata stripped and are listed in the extract manifest, but their pixels ship unread: a scanned signature or a screenshot leaves in plaintext until the image pipeline runs.
Field codes, SmartArt, chart caches and embedded OLE objects are copied through unexamined; a document that carries them should not ship on this handler alone.
Legacy .doc binaries are not readable here; they route through the legacy-office handler, which converts them with LibreOffice and delegates back to this one (withheld when no converter is installed).
Metadata channels reached: core_properties, app_properties, comments, comment_authors, footnotes, endnotes, tracked_changes, text_boxes, hyperlink_targets, embedded_media_metadata
.pptx
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Headers and footers
The running strip on every page, which is where a client name usually repeats.
Link text
The words a reader sees where a link sits.
Link targets
The address behind the link, where an account id or a mailbox often hides.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Table cells
Text inside tables is reached cell by cell, not only the prose around them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Embedded images get their EXIF/XMP metadata stripped and are listed in the extract manifest, but their pixels ship unread: a name burned into a screenshot or a headshot leaves in plaintext until the image pipeline runs.
Chart data caches, SmartArt and embedded OLE objects are copied through unexamined; a deck that carries them should not ship on this handler alone.
Shape names and alt text are not yet rewritten (a picture's shape name defaults to its original filename, which can be a person).
Legacy .ppt binaries are not readable here and are not converted; only OOXML .pptx is handled.
Metadata channels reached: core_properties, app_properties, comments, comment_authors, speaker_notes, hyperlink_targets, embedded_media_metadata
.xlsx
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Headers and footers
The running strip on every page, which is where a client name usually repeats.
Link text
The words a reader sees where a link sits.
Link targets
The address behind the link, where an account id or a mailbox often hides.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Table cells
Text inside tables is reached cell by cell, not only the prose around them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Formula string literals are replaced but a cell's cached numeric results are never rewritten, so a number derived from redacted text (a LEN(), a lookup position) still reflects the original until Excel recalculates.
Embedded images get their EXIF/XMP metadata stripped and are listed in the extract manifest, but their pixels ship unread: a name burned into a screenshot leaves in plaintext until the image pipeline runs.
Pivot caches, external-link caches, data connections and VBA projects are copied through unexamined; a workbook that carries them should not ship on this handler alone.
Legacy .xls binaries are not readable here and are not converted; only OOXML .xlsx is handled.
Metadata channels reached: core_properties, app_properties, comments, threaded_comments, sheet_names, defined_names, hyperlink_targets, embedded_media_metadata
.doc .ppt .xls
Converted

Comes back as a different kind of file from the one that went in.

What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Footnotes
Notes are handled as body text rather than skipped as furniture.
Headers and footers
The running strip on every page, which is where a client name usually repeats.
Link text
The words a reader sees where a link sits.
Link targets
The address behind the link, where an account id or a mailbox often hides.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Table cells
Text inside tables is reached cell by cell, not only the prose around them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Tracked changes
Text held in insertions and deletions, which survives accepting the changes.
What it will not do
Delivered as .docx/.xlsx/.pptx — never the original binary format: LibreOffice converts on ingest, the manifest records converted_from, and layout fidelity is conversion-grade (features with no OOXML equivalent may shift or drop).
On a host without LibreOffice (soffice) these files are WITHHELD with an install-aware reason, never passed through; installing LibreOffice enables conversion (the word_converter row on /v1/capabilities shows converter presence).
A file the converter cannot read — corrupt, password-protected, or a different format wearing the extension — is withheld with the converter's error, never delivered unchecked.
All caveats of the corresponding modern-format handler apply to the converted output.
Metadata channels reached: app_properties, comment_authors, comments, core_properties, defined_names, embedded_media_metadata, endnotes, footnotes, hyperlink_targets, sheet_names, speaker_notes, text_boxes, threaded_comments, tracked_changes
Text and structured data
18 formats
.log .txt
Same format back
What happens
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identity split across a hard line wrap ('Marisol\nVane') is not joined; each line is matched independently, so a wrapped surface can survive.
.py
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
f-string interpolation expressions are treated as literal string text, not code.
.js
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
Regex literals (/.../) are scanned as code; identity inside a regex pattern survives.
.ts
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
Regex literals (/.../) are scanned as code; identity inside a regex pattern survives.
.java
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
.sql
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
Double-quoted tokens are identifiers, not strings, and are never rewritten — a client name used as a quoted column name survives.
.sh
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
Heredoc bodies (<<EOF) are scanned as code, not as string content; identity there is only caught if quoted.
.go
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
.rb
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
%q/%Q and heredoc string forms are scanned as code; identity there survives unless conventionally quoted.
.c
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
.cpp
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
String literals only
In code, only quoted strings are touched. Identifiers, keys and syntax are left alone.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identifiers are never rewritten (buildability rule): a variable or table literally named after the client survives in code position even when every string and comment mention is replaced.
.xml
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Values, not keys
Field names survive, so the file still parses and still joins to its siblings.
What it will not do
Element and attribute NAMES are structure and never rewritten; identity used as a tag name survives.
Numeric character references (&#8217;) are not decoded before matching; a surface written partly as character references survives.
.htm .html
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Values, not keys
Field names survive, so the file still parses and still joins to its siblings.
What it will not do
script/style bodies are emptied wholesale (trust rule), so a page whose rendering depends on inline script will not behave in a browser.
Attributes other than alt/title/aria-label (href, data-*, id, class) are structure and never rewritten; identity in a URL or data attribute survives the attribute even when the visible text is replaced.
Metadata channels reached: script, style, comment
.json
Same format back
What happens
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Values, not keys
Field names survive, so the file still parses and still joins to its siblings.
What it will not do
Keys are structure and are never rewritten; identity used AS a key ('"Marisol Vane": {...}') survives and must be caught in review.
Numbers are never rewritten; an identifying bare number (an account id stored as int, not string) survives.
.md
Same format back
What happens
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Fence delimiter lines are never rewritten, so an info string that names a client ('```acme-config') survives.
Reference-style link definitions are fixed as plain text, not as structured destinations; a replacement containing whitespace could split such a URL.
.csv
Same format back
What happens
Table cells
Text inside tables is reached cell by cell, not only the prose around them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identity split across two cells ('Marisol','Vane') is matched per cell and can survive; cross-cell joins are a detection concern, not an applier one.
Delimiter is sniffed from the first 4KB; a file whose first rows are not representative falls back to comma.
.tsv
Same format back
What happens
Table cells
Text inside tables is reached cell by cell, not only the prose around them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
What it will not do
Identity split across two cells is matched per cell and can survive.
.yaml .yml
Same format back
What happens
Comments
Review comments are rewritten. They routinely name the person who left them.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Values, not keys
Field names survive, so the file still parses and still joins to its siblings.
What it will not do
Keys are structure and never rewritten; identity used as a mapping key survives and must be caught in review.
Flow-style collections ({k: v, ...}) are fixed as one value string, so a key INSIDE a flow mapping is treated as value text.
Anchors/aliases (&x, *x) are fixed as plain value text; a replacement landing inside one would rename the anchor everywhere it is used.
PDF
1 format
.pdf
Same format back
What happens
Annotations
Sticky notes, form field values and PDF comments.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Regions blacked out
Detected areas are painted over in the pixels, not annotated on top of them.
Scanned pages
A page with no text layer is read by OCR and handled as an image.
Text layer rewritten
The PDF's own text is edited, so copying out of the file yields the replacement.
Token placeholders
Replacements are stable tokens, so one person reads the same way throughout the corpus.
Members withheld
A member the engine cannot handle is left out rather than passed through untouched.
What it will not do
spans in subset-embedded or CID-keyed fonts are not rewritten in place; they get a redaction box with the replacement stamped over it
replacements longer than the original span fall back to box + overlay; text is never reflowed
scanned pages are OCR-matched and blacked out; without an OCR engine the page is withheld with a stamped notice, never shipped unread
pictures on text-bearing pages are not inspected in this phase; the apply report lists the pages that carry them
the XMP metadata packet is removed rather than rewritten; identity fields survive only in the scrubbed Info dictionary
hyperlink targets the replacement pass cannot vouch for are stripped
Metadata channels reached: info_dict, xmp, annotations, outline
Images
1 format
.bmp .jpeg .jpg .png .tif .tiff .webp
Same format back
What happens
EXIF stripped
Camera, location and timestamp metadata is removed from the image file.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Metadata cleared
Document properties are emptied: author, company, last saved by.
Text read off the pixels
Characters are recovered by OCR first, so an image of a page is not treated as empty.
Regions blacked out
Detected areas are painted over in the pixels, not annotated on top of them.
Token placeholders
Replacements are stable tokens, so one person reads the same way throughout the corpus.
What it will not do
OCR is best-effort on low-contrast or stylized text; a surface OCR cannot read is not located by this pass
logo/stamp/signature detection is not yet wired (design in docs/image-identity.md); the visual channel tonight covers OCR-readable text only
when the OCR stack is missing the file is flagged ocr_unavailable, never reported clean
jpeg re-encode may alter untouched pixels; byte-identity is not guaranteed for lossy formats
xmp and iptc are stripped, not rewritten; tiff and bmp metadata is stripped wholesale
Metadata channels reached: exif, gps, xmp, iptc
Email
1 format
.eml
Same format back
What happens
Headers and footers
The running strip on every page, which is where a client name usually repeats.
Metadata replaced
Document properties are rewritten to stand-ins, so the fields still read as filled in.
Members opened
The archive is unpacked and each file inside is handled on its own terms.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Members withheld
A member the engine cannot handle is left out rather than passed through untouched.
What it will not do
Only From/To/Cc/Subject are rewritten; Received/Message-ID/Return-Path routing headers carry real hosts and addresses and currently ship — strip them upstream or extend the header list before delivering raw .eml.
A changed part is re-encoded under its original transfer encoding; its bytes differ even where the text did not (line wrapping of base64/qp).
Metadata channels reached: header:From, header:To, header:Cc, header:Subject
Archives
1 format
.zip
Same format back
What happens
Metadata cleared
Document properties are emptied: author, company, last saved by.
Members opened
The archive is unpacked and each file inside is handled on its own terms.
Body text
Identified values are replaced where they sit, leaving the rest of the sentence intact.
Members withheld
A member the engine cannot handle is left out rather than passed through untouched.
What it will not do
Withheld members are DROPPED from the delivered archive (named in LINDO-WITHHELD.txt); the recipient does not get the original bytes.
Archive-level metadata (member timestamps, comments) is not scrubbed; timestamps can date the engagement.
Encrypted members cannot be read and are withheld.
Metadata channels reached: member-name