Documents and text
This page is the authoritative list of what SafeRedact processes, how each format is handled, and where the edges are. When in doubt about an export, check here before uploading.
PDF, DOCX, XLSX, TXT, HTML, CSV, and JSON are processed directly. Text is extracted, detections run against it, and the redacted output is rendered to PDF, with structured formats also reflected in the reports.
Scanned or image-only PDFs are the main caveat: a PDF with no text layer yields no text to scan. The confidence dashboard flags zero-detection files during review for exactly this reason; treat a flagged scan as unreviewed content and handle it separately.
EML files are processed as full MIME messages: headers, recipients, body, and attachments, with each attachment routed through the matching extractor above. This is the format PST extraction produces internally, and it has the deepest coverage.
PST is the recommended export format for mailboxes. Each PST is unpacked in the browser: every message becomes an EML, and attachments are carried across and scanned, including messages embedded inside messages. Attachment handling has defined limits (up to 20 attachments per message, 25MB per attachment), and anything beyond a limit is marked with an explicit placeholder rather than dropped without trace. In Microsoft Purview, set the PST package size to 1GB or 2GB; large mailboxes then split across packages automatically, and the app enforces a 2GB per-file ceiling with instructions if an oversized package arrives.
MSG files process with an important limitation: message bodies, headers, and recipients are detected, but attachment content inside a .msg is not examined. If a mailbox was already exported as .msg, the messages themselves still process; treat attachments as unreviewed, and either re-export that mailbox as PST or collect the attachments separately and upload them alongside.
Containers
ZIP packages, including Purview’s SharePoint and OneDrive collections, are unpacked and their contents routed by type. Unsupported entries inside a container are not processed; the pack’s coverage information notes them so they can be handled deliberately. A Purview collection routinely includes image files, which fall under the next heading.
Not processed
Images (standalone JPG, PNG, TIF) are not processed, whether uploaded directly or found inside a container. To find them in a Purview export, filter the export’s Items report by file extension, then handle them outside SafeRedact.
Video and audio are out of scope entirely. CCTV, bodycam, and call-recording redaction is a separate tool category; if a request spans documents and footage, plan for two tools from the start.
Checking an export before you start
Purview’s Items report lists every exported item with its type. Two minutes filtering it answers the questions that matter: how many items are in formats above, whether image files are present, and whether partially indexed items were included in the export. Partially indexed items are excluded by default and must be opted in at export time; they are also disproportionately the scanned and encrypted material a DSAR needs deliberate decisions about. The Purview export guide covers the export-time settings themselves.