Enterprise edition

Privacy — Deep Reference

At a glance

This deep reference documents detection, the redaction and suppression strategies, the deterministic pseudonym contract, and the at-rest map seal.

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

Behavior contract

Detection scans text against a pattern registry. The built-in registry targets email addresses, phone numbers, United States Social Security numbers, credit-card numbers, and Taiwan national-ID numbers; a deployment may register additional patterns. Detection is pattern-scoped: a value no pattern matches is not found, and a no-text-layer page yields no matches.

A redaction policy selects target entity types, a redaction toggle (detect-only versus destructive), and a replacement style (black box, white box, or text replacement). In destructive mode the engine replaces matched spans from the end of the text backward so earlier offsets stay valid; in detect-only mode it returns findings without changing content. The de-identifier adds a suppression strategy that removes whole lines containing a match. Every run returns the SHA-256 of the original text, the modified content, an itemized report, an entity count, and a modified flag.

Pseudonymization is reversible by design. A pseudonym is derived from an HMAC-SHA-256 over the original value and a per-session seed, formatted to a type-aware shape (for example, an ID-like or email-like token). The same value maps consistently within a session; different sessions do not correlate. The original-to-pseudonym map is serialized as key_version || nonce || ciphertext || tag and sealed with AES-256-GCM under a versioned key. Rehydration reads the key version from the header, decrypts, and restores originals longest-match-first. Without the correct key version and the matching encrypted map, originals are not recoverable from the pseudonymized text alone. This is pseudonymization, which is reversible with the separate mapping (ISO/IEC 29100:2024 §2), not anonymization, which aims to be irreversible (§2). De-identification reduces but does not eliminate residual re-identification risk (ISO/IEC 29151:2017).

The audit trail is append-only and records a session id, operation, entity count, a policy hash, a timestamp, and a tenant id. It does not record detected values.

Public API surface

NextPDF\Enterprise\Privacy\PiiDetector, NextPDF\Enterprise\Privacy\RedactionEngine, NextPDF\Enterprise\Privacy\DeIdentifier, NextPDF\Enterprise\Privacy\RedactionPolicy, NextPDF\Enterprise\Privacy\PseudonymizationEngine, NextPDF\Enterprise\Privacy\PrivacyGateway, NextPDF\Enterprise\Privacy\RehydrationService, NextPDF\Enterprise\Privacy\EncryptedMapSerializer, NextPDF\Enterprise\Privacy\PrivacyAuditTrail, and the EntityType / RedactionStyle / DeIdentificationStrategy enums. Signatures are listed on the public page.

Conformance

The model maps to ISO/IEC 29100:2024 §2 (de-identification, pseudonymization, anonymization) and ISO/IEC 29151:2017 (de-identification controls). The surface performs pattern-scoped redaction, suppression, and reversible pseudonymization as tested; it does not anonymize and makes no regulatory-compliance claim.

Edge cases & FIPS-mode behavior

Format-aware pseudonyms preserve a shape; a checksum-validating downstream system may reject a pseudonym. That is expected.
The encrypted map is the sensitive artifact: lose it and rehydration is impossible; leak it with its key and the pseudonymization is reversible by a third party. Key custody and map storage are deployment responsibilities.
The at-rest seal uses AES-256-GCM through the platform crypto provider. When the host runs a FIPS-validated provider, that operation runs in the validated boundary. The library is not itself a FIPS-validated module and makes no FIPS certification claim.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.

Core fallback

NextPDF Core (Apache-2.0) has no PII detection, redaction, or pseudonymization surface — none; this capability has no Core-tier equivalent.

Pro fallback

NextPDF Pro ships text-layer PII detection and generation-time masking; it does not provide reversible pseudonymization, the encrypted at-rest map, line suppression, or the append-only audit trail. Those ship in the nextpdf/enterprise package only.

Enterprise boundary note

Detection patterns, redaction/suppression strategies, the deterministic pseudonym contract, and the at-rest map seal are described at the behavior level. The library consumes a versioned key; it does not manage a key store, and key generation, custody, and rotation internals are out of scope and are not reproduced here.

Deployment boundary

The encrypted map and any rehydrated output are personal data; where they are stored and which jurisdiction processes them is a deployment responsibility outside the library’s boundary. Key generation, custody, and rotation are the deployment’s responsibility — the library consumes a key version, it does not manage a key store. Lose the map and rehydration is impossible; leak it with its key and the pseudonymization is reversible by a third party.

Legal-compliance boundary

The at-rest map uses authenticated encryption, so treat this surface as security-sensitive in your own review. The surface performs pattern-scoped de-identification as tested; it does not anonymize and makes no regulatory-compliance claim. This reference is not a legal opinion; consult your own compliance and legal advisers.