What should I redact from a client tax document?

It depends who is receiving it and what they need, but the usual list is the Social Security number or ITIN, the EIN where the entity is not the point, the client and spouse and dependent names, signatures, the street address, date of birth, phone and email, and any bank account or routing numbers, which appear on a return whenever there is a direct deposit or debit. Employer and account numbers are worth a look too, since they can lead back to a person on their own.

Why is a black box over the Social Security number not enough?

A rectangle drawn with a markup tool sits on top of the page. The digits underneath stay in the file and can still be selected, copied and searched. Real redaction removes the characters and then draws the box. The way to tell the difference is to open the exported copy and search it for the number you removed.

Does this handle scanned returns and paper documents?

Yes. A scanned return is an image, so there is no text for a normal tool to find. Lex Cloak runs OCR on those pages first, then looks for sensitive information in what it reads. A scan can also carry an invisible text layer from whatever produced it, which is why searching the exported file matters even when the page looks like a picture.

Can I do a whole client file at once?

Yes. You can load several PDFs and redact them in one pass, which is the usual shape of a records request or a document production. Each one is still reviewed before anything is burned in.

Do the files leave my computer?

No. Detection and redaction both run inside the app on your own machine, so client documents stay where you control them. The only network request the app makes is a periodic licence check, which carries no document content.

Does this make my practice compliant with the Safeguards Rule?

No, and be wary of any tool that says it does. Tax preparers are subject to the FTC Safeguards Rule under the Gramm-Leach-Bliley Act, and the IRS asks tax professionals to keep a Written Information Security Plan. That is a program, covering people, procedures and systems, not a feature you can buy. Keeping client documents on your own machine and removing identifiers before you share a copy are two controls that can sit inside such a plan. The plan is still yours to write and follow.

How to redact client tax documents

A tax return carries more identifying information per page than almost anything else a practice handles. Before a copy goes to a lender, an expert, opposing counsel, a new bookkeeper or an AI tool, the identifiers have to come out of the file rather than be covered over. Lex Cloak finds them on your own computer, reads scanned pages, handles a whole client file at once, and checks the exported copy before you send it.

Download Lex Cloak Check a redaction worked

What to take out of a return

What has to go depends on who is receiving the document and why. This is the list worth walking before a copy leaves the practice.

Identifier	Where it turns up	Worth knowing
SSN or ITIN	Top of the 1040, on W-2s, on most schedules and attachments	Repeats across a package, so a page-by-page eye pass is where one gets missed
EIN	Business returns, K-1s, W-2s, 1099s	Often needs to stay when the entity is the point, and to go when it is not
Bank account and routing numbers	Direct deposit and direct debit lines on the return itself	Easy to forget, because it is a figure among other figures
Names and signatures	Client, spouse, dependents, and the signature block	Dependent names are on schedules people do not always reread
Address, date of birth, phone, email	Header of the return, and correspondence bundled with it	An address alone can re-identify a return matched against public records
Metadata and hidden content	Document properties, comments, attachments, form fields	Sits outside the page, so reading the pages never reveals it

Scanned returns and client paper

Much of what arrives in a practice is a scan or a photograph. There is no selectable text on those pages, so a tool that searches for a Social Security number finds nothing and reports a clean document. Lex Cloak reads the page with OCR first and then looks for identifiers in what it read, which is the only way a number printed on paper gets found at all.

Why the standard is higher for a tax practice

Professional tax return preparers are treated as financial institutions under the Gramm-Leach-Bliley Act, which brings them inside the FTC Safeguards Rule. The IRS asks tax professionals to keep a Written Information Security Plan covering how client data is protected, and publishes guidance on building one in Publication 4557 and Publication 5708.

Lex Cloak does not make a practice compliant, and no software can. A security plan is people, procedures and systems, and it stays yours to write and follow. What a tool can do is narrow two specific risks inside it: client documents that travel to a third party to be processed, and identifiers that stay readable in a copy someone thought was clean.

Before a return goes into an AI tool

Pasting a return into an assistant to summarise, check or explain it sends the client's identifiers to a service outside the practice. Removing them first turns that into a document about numbers rather than a document about a person. Because Lex Cloak runs on your machine, the sanitising step does not itself involve sending the file anywhere.

What it does not do

Detection is a starting point, not a verdict. Lex Cloak proposes matches and you review them, keep them, remove them, or add your own before anything is burned in. Auto-detection is not exhaustive, and a document you know well is one you should still read.

What it does check is the finished file. Before handing back an export it looks for targeted text that is still extractable, for form fields and annotation residue carrying readable data, and for machine-readable codes that still decode. If something turns up it stops and tells you. How that check works.

Common questions

What should I redact from a client tax document?: It depends who is receiving it and what they need, but the usual list is the Social Security number or ITIN, the EIN where the entity is not the point, the client and spouse and dependent names, signatures, the street address, date of birth, phone and email, and any bank account or routing numbers, which appear on a return whenever there is a direct deposit or debit. Employer and account numbers are worth a look too, since they can lead back to a person on their own.
Why is a black box over the Social Security number not enough?: A rectangle drawn with a markup tool sits on top of the page. The digits underneath stay in the file and can still be selected, copied and searched. Real redaction removes the characters and then draws the box. The way to tell the difference is to open the exported copy and search it for the number you removed.
Does this handle scanned returns and paper documents?: Yes. A scanned return is an image, so there is no text for a normal tool to find. Lex Cloak runs OCR on those pages first, then looks for sensitive information in what it reads. A scan can also carry an invisible text layer from whatever produced it, which is why searching the exported file matters even when the page looks like a picture.
Can I do a whole client file at once?: Yes. You can load several PDFs and redact them in one pass, which is the usual shape of a records request or a document production. Each one is still reviewed before anything is burned in.
Do the files leave my computer?: No. Detection and redaction both run inside the app on your own machine, so client documents stay where you control them. The only network request the app makes is a periodic licence check, which carries no document content.
Does this make my practice compliant with the Safeguards Rule?: No, and be wary of any tool that says it does. Tax preparers are subject to the FTC Safeguards Rule under the Gramm-Leach-Bliley Act, and the IRS asks tax professionals to keep a Written Information Security Plan. That is a program, covering people, procedures and systems, not a feature you can buy. Keeping client documents on your own machine and removing identifiers before you share a copy are two controls that can sit inside such a plan. The plan is still yours to write and follow.