Solander

Redaction you can prove. Solander redacts PDFs and scans on your Mac, then re-reads its own output to check the boxes held. It tells you what it could not read, lists what it removed from the file, and gives you a record a third party can re-check.

Download for macOS Pricing
macOS On-Device No Network One-Time Purchase

Free for one document at a time, with no time limit and no account.

What it does

You open a PDF or a scan, review what Solander found, mark what has to go, and export. Every page is rendered to an image, the redactions are painted into it, and a new file is written from scratch. Nothing from the original is carried across — no text layer, metadata, annotations, attachments, form fields or earlier saved versions — because nothing is copied in the first place.

Then Solander reopens the file it just wrote and reads it again, looking for anything still legible where a redaction was meant to be. That result is shown to you whether or not you have a licence.

Redacts by rewriting A redaction is not a black rectangle drawn over text that is still in the file. The page becomes an image, the fill is opaque, and the output is a newly constructed document. There is no layer underneath to recover.
Checks its own work After writing, the output is reopened and re-read, and the file's internal structure is walked against an allowlist of permitted objects. A redaction that failed to cover what it was meant to cover is reported as a residual, not silently exported.
Says what it could not read Text the OCR located but could not resolve is listed and shown on the page, so you know which parts of a document no detector ever examined. Unreadable is reported as unreadable rather than treated as clean.
Inventories the original Before anything happens, Solander lists the hidden surfaces the source file carried: metadata keys, attachments, annotations, scripts, optional content groups, and content sitting outside the visible page area.
Batch and entity map Work a folder of documents as one job, with an entity map that keeps the same person named consistently across every file — merge spellings, split false matches, apply a decision everywhere. Interrupted batches resume. Licensed.
Evidence you can hand over A signed report in PDF and JSON: what was redacted, under which reason code, what was verified, what could not be read, and what the original contained. The recipient can re-check it against the file without taking your word for it. Licensed.
Automation Saved profiles, a solander command-line tool, and watch folders that process documents as they arrive. Licensed.

What Solander does not tell you

A passing check means no readable text remains inside the regions that were redacted. It does not mean everything sensitive was found.

Detection is best-effort and misses things, particularly names, addresses and non-Latin text. Solander never describes a document as anonymous, compliant, safe or clean, and neither should anyone relying on it. Deciding what must be removed, and checking that it was, stays with you. Solander is a tool for that work and evidence of what it did — not a substitute for the judgement, and not legal advice.

Privacy by architecture

Your documents never leave your Mac. This is enforced by the operating system rather than promised by us: Solander runs in Apple's App Sandbox without the network client entitlement, so macOS will refuse any outbound connection regardless of what the code asks for.

No account, no sign-in, no telemetry, no analytics, no crash reporting. Your licence is a signed file, and that signature is checked on your own Mac against a key compiled into the app.

A separate helper process confirms about once a week that the purchase behind your licence has not been refunded. It sends your licence ID, the app version and a random install ID — nothing about your documents, and nothing about your Mac. It is a different process from the one that opens your files, and the one that opens your files still cannot connect to anything at all.

You can verify this on the copy you downloaded. codesign -d --entitlements - /Applications/Solander.app
Two separate helper processes use the network: one checks for updates, one confirms your licence. Neither ever receives a document, a page image, or anything Solander detected. Update checks can be switched off. For a Mac that must never connect, there is offline activation.

Pricing

Bought once, not rented. There is no subscription, no renewal and no expiry: the version you buy keeps working, and so does every version after it.

Free $0no account One document at a time. Every detector, every language, review, redaction, export, and the verification result. No time limit, no feature clock, no watermark. Download
Solander $49once, one person Batch and the entity map across documents, signed reports, reason codes and the redaction log, saved profiles, the command line and watch folders. Use it on as many of your own Macs as you like. Every future version included. Nothing to renew. Coming soon Email me at launch
Organisations Talk to usone invoice, one licence More than one person, or deploying across a managed fleet. One invoice in the firm’s name rather than a pile of card receipts, licences and settings deployed by configuration profile, and an organisation signing key so every report your firm produces carries the same signature — a recipient who has verified one can recognise the next. Tell us how many people and how you deploy, and we will quote. Email us

Solander is not on sale yet. Free mode is available now and has no clock on it — download it and try it on your own documents. When the licensed version goes on sale, prices will be in USD, with sales tax or VAT added at checkout where applicable; orders will be processed by Paddle.com Market Ltd, who act as merchant of record and issue the invoice, and your licence will arrive by email as a signed file you double-click to install. See Refunds and Terms.

Lost your licence file? Ask us to send it again from the address you bought with.

System requirements

macOS macOS 14 Sonoma or later, Apple Silicon or Intel. Signed with a Developer ID, notarised and stapled by Quiet Signals Lab.
Documents PDFs, including scanned ones, and common image formats. Output is a newly written PDF with the pages rendered as images.
Deployment Licences and locked profiles deploy by configuration profile for the app's bundle identifier, which works inside the sandbox. A licence file dropped in /Library/Application Support will not.

Frequently asked questions

Do my documents go anywhere?

No. The app has no network client entitlement in its sandbox and cannot open an outbound connection. Update checks run in a separate process that never receives document data, and you can switch them off.

What does a passing verification actually mean?

That Solander reopened the file it wrote and found no readable text inside the regions you redacted. It is a statement about those regions, not about the document as a whole, and not about whether the right things were chosen for redaction.

Do I have to buy anything to find out whether it works on my documents?

No. Free mode has every detector and every language, and lets you open, review, redact, export and verify one document at a time, with no time limit and no account. A licence adds working on many documents at once, the exportable evidence, and automation.

Is there a subscription?

No. A licence is bought once, covers every future version, and there is nothing to renew. A separate helper process does confirm about once a week that the purchase has not been refunded. If it cannot reach us, the licensed features keep working for 30 days; if your Mac is never allowed online, there is offline activation.

How is the licence delivered?

As a signed file emailed to you after purchase. Double-click it and the app installs it. The signature is checked on your Mac against a key compiled into the app, so a new licence works straight away, including on a machine that has never been online. A Mac that stays offline has 60 days before it needs either one internet connection or an offline activation code.

What happens to my licence if I ask for a refund?

It is deactivated, and the licensed features stop working. Free mode keeps working exactly as before, with no time limit: you can still open, review, redact, export and verify one document at a time. Documents and reports you have already produced are untouched. See Refunds.

What exactly does the licence check send?

Your licence ID, the app version, and a random install ID generated once when you install. Nothing else. Not a document, not a filename, not a page, not anything Solander detected, and no hardware identifier — the install ID is random and changes if you reinstall. It goes from the helper process, not from the app that opens your files, which has no network access to send anything with. What we store is set out in the privacy notice.

Can I run Solander on a Mac that is never allowed on a network?

Yes. The app shows a short request code; you type it into a page from your phone or another computer and get a response code back, which you type in once. A first activation lasts 15 days and each renewal lasts 90, and renewing is the same few steps again. Nothing leaves the air-gapped Mac except a code you read off the screen.

Does it replace a person checking the document?

No. Detection misses things, especially names, addresses and non-Latin text. Solander is built to tell you where it is uncertain rather than to hide it, but the review step exists because no detector has perfect recall.

Support

Solander is built and maintained by Quiet Signals Lab. For bug reports, licence questions, refunds, or anything else, reach out directly.

Include your macOS version and what happened. Please do not send us a document you needed to redact — a description of the failure is enough, and if you must send a file, send one you have already redacted.

hello@quietsignalslab.com →

Solander is document redaction software. It is not identity-theft protection, device security software, or legal advice, and it does not determine whether a disclosure meets any legal obligation.