GUIDE · FERPA

FERPA Redaction Software That Proves the Data Is Gone

Published June 22, 2026 · ~6 min read

You have a records request on the clock and a stack of files full of student names, IDs, and the occasional Social Security number. Get it right and nobody notices. Get it wrong — leave one name behind, or "redact" with a black box that copy-pastes right off — and you have a privacy incident, a parent complaint, and a paper trail that says it was avoidable.

FERPA redaction software exists to take that risk off your desk. But most tools stop at drawing a box over the text. RedactWorks goes one step further: it re-checks the file you're about to release and holds the download behind a warning if any student data you approved for removal can still be read. That last step is the difference between hoping the redaction worked and knowing it did.

How should a school district redact student records for a FERPA request?

The short version, in the order records offices usually work:

1. Decide what can be released. Confirm whether consent or a FERPA exception applies before redacting anything.
2. Find direct and indirect identifiers. Names, student ID numbers, SSNs and dates of birth, plus details that would let someone in the school community identify the student (a small class, a unique incident, a rare program).
3. Remove, don't cover. Use true redaction that deletes the text under the box. Drawing black shapes in a PDF editor leaves the text copyable.
4. Clean the file. Clear metadata, comments, attachments and form fields, which can all carry a student's name.
5. Verify before release. Search the finished file for every name and number you removed, and look at scanned pages by eye. Our guide on how to verify a PDF redaction covers the six checks.
6. Keep a record. Note what was withheld and why, in case the release is questioned later.

RedactWorks automates steps 2 through 6: it proposes the identifiers, you approve, it removes and cleans, re-checks the result, and gives you a downloadable decision log.

What FERPA actually requires of you

FERPA protects the privacy of student education records. Before a school or agency discloses personally identifiable information (PII) from those records, it generally needs written consent from the parent or eligible student — unless a specific exception applies (34 CFR Part 99, Subpart D).

The part that makes redaction hard is the definition of PII. Under FERPA it isn't just names and Social Security numbers. It includes indirect identifiers — and the working test is whether information would let a reasonable person in the school community identify a specific student with reasonable certainty (U.S. Department of Education). A grade level here, a date of birth there, a small-class detail — combined, they can re-identify a student even when the obvious identifiers are gone.

That's why manual redaction is slow and error-prone. You're not scanning for one pattern. You're reading every page for anything that, in context, points back to a student. One missed line is a disclosure.

Why a black box isn't redaction

A black rectangle drawn over text only covers it. The underlying characters stay in the file, recoverable with a copy-paste.

This isn't a theoretical risk. In January 2019, attorneys in the Paul Manafort case filed a court document with sections blacked out — and a reporter recovered the "redacted" text simply by copying and pasting it, revealing material the defense had fought to keep sealed (The Hill; Vice). The black boxes were drawn on top of the text layer, not removed from it.

If a legal team with everything on the line can ship a copy-pasteable redaction, so can a records office working through a queue at the end of the month. The fix isn't more careful boxing. It's removing the data from the file.

What "verified redaction" means for a records office

RedactWorks runs the same four steps on every document:

1. Detect. The tool scans for PII — names, IDs, SSNs, dates, and the other identifiers that re-identify a student in context. Social Security numbers, student ID numbers, bank and card numbers, and medical record numbers are locked on, so nobody can unmark them by accident.
2. Human review and approval. You see the highlighted findings and approve before anything is destroyed. The software proposes; a person decides. Nothing is removed without sign-off.
3. Permanent redaction. Approved items have their underlying text layer removed and metadata stripped — not a visual cover. The verify pass then re-scans the output file to confirm they're gone.
4. Verify. Every redacted file is re-checked for the items you approved: its text, metadata, annotations and attachments, plus an OCR re-read of scanned pages. If anything can still be read, the download is held behind a warning; releasing it anyway takes an explicit acknowledgment, which is logged.

That fourth step is the one built for your job. The verify pass is what lets you release a file knowing a second, independent check confirmed the student data is gone — instead of trusting that the boxes landed in the right places.

To be clear about what software can and can't do: no tool can guarantee a perfect outcome, and FERPA judgment calls still belong to a person. What RedactWorks does is keep a human in the loop and hold back a file that fails its own re-check until you explicitly decide otherwise. Hand-drawn boxes and whole-page redactions aren't text-checked, so give those a visual check (see how to verify a PDF redaction). That's a defensible workflow, not a magic button.

Built for how records work actually gets done

RedactWorks is hosted and self-serve: start free and redact right in your browser, no install and no procurement cycle. It's built for the person who actually prepares the release — you see every finding, approve every redaction, and the file is re-verified before it goes out.

Your documents are never used to train AI — and that's enforced by Google Cloud's Vertex AI Training Restriction, which is Google's contractual commitment, not just ours.

Frequently asked questions