Product and intended use
Define the configuration, people, information and tasks being assessed.
Product and plan covered
Public claim only
The product FAQ, checked 2026-09-27, states that Smart Redact 'is only available with a Foxit PDF Editor+ subscription' and that 'If you're using the standard version of Foxit PDF Editor or a perpetual license, you won't see the Smart Redact feature.' It states that once Editor+ is purchased 'users receive a quota of 50 documents', after which in-app purchase plans provide 200, 1,000 or 2,400 documents a year. The General Terms of Service list Additional Terms for Foxit eSign, Foxit Editor Desktop, Foxit Cloud Service, Foxit Workspace, Foxit AI User Guidelines and Foxit APIs, and provide that Additional Terms govern over the General Terms for the specific product; no Smart Redact additional terms appear in that list.
Ask: Which of the Additional Terms listed in the General Terms of Service govern Smart Redact — the Foxit Editor Desktop EULA, the Foxit Cloud Service terms, the AI User Guidelines, or a combination — and will you state that in writing?
Deployment and where processing happens
Public claim only
The product page presents Smart Redact as a plug-in built into Foxit PDF Editor+ and states in the FAQ that 'files are securely processed in the cloud for redaction', hosted 'on Azure', with AES-256 protecting 'all data transmissions between the Foxit cloud and our PDF Editor'. Detection therefore does not run on the device: the document leaves the workstation to be analysed. No hosting region is named for that cloud processing anywhere on the page. A separate product, Smart Redact Server, is published for batch redaction across other systems and is a different deployment that this profile does not cover.
Ask: In which Azure region does Smart Redact analyse and redact a document uploaded from an Australian workstation, and can that region be fixed for our tenancy?
Documented functions and limits
Public claim only
The product page states that Smart Redact detects and marks sensitive data 'without manual tagging', covering 'visible, hidden, and metadata' content, and that detectable data includes 'names, Social Security numbers, phone numbers, emails, credit card details, and more', with user-defined 'custom keywords or phrases' as an addition. The FAQ states the user is given 'a full preview of suggested redactions before anything is applied' and can 'review, edit, or remove items'. The page also describes building and reusing 'tailored redaction profiles' for repeated workflows. No file size limit, page limit, language coverage or list of supported document types is published on the page.
Ask: What are the published limits for Smart Redact — maximum file size and page count, supported languages, and behaviour on scanned or image-only PDFs that require OCR?
Jurisdictional coverage of detection
Not confirmed
The detection categories published on the product page on 2026-09-27 are United States-centric: 'names, Social Security numbers, phone numbers, emails, credit card details'. The compliance obligations named are GDPR, HIPAA, FOIA, PCI, DSS and FINRA. No Australian identifier type is named anywhere on the page — there is no reference to tax file numbers, Medicare numbers, Australian driver licence numbers, ACN or ABN — and no jurisdiction or locale setting for detection is described. Custom keywords and phrases are the only published mechanism for content the model does not detect by default.
Ask: Which Australian identifier types does the Smart Redact detection model recognise without custom keywords — tax file number, Medicare number, driver licence number, passport number, ACN and ABN — and is there a jurisdiction setting?
Vendor guidance on what may be submitted
Public claim only
The Foxit AI Assistant Security Overview, checked 2026-09-27, states that 'Users should not submit personal, confidential, regulated, or other sensitive information unless their organization permits the intended processing path' and that 'Customers remain responsible for determining whether their intended content and processing path are permitted by applicable law, organizational policy, and contract'. The published purpose of Smart Redact is to detect exactly that class of information in a document, and its FAQ states the document is processed in the cloud. The Overview's own scope statement names AI Assistant in PDF Editor, integrated Editor AI features and Foxit Workspace, and does not name Smart Redact.
Ask: Which processing path does Foxit consider permitted for privileged client documents sent to Smart Redact, and does that guidance in the Security Overview apply to Smart Redact at all?
Vendor content directing how AI describes the product
Not confirmed
Checked deliberately on 2026-09-27. No page or block addressed to AI models, assistants, crawlers or large language models was found: the Smart Redact product page, the AI Assistant Security Overview, the Trust Center, the General Terms of Service and the privacy policy contain no 'Instructions for AI Assistants' heading or equivalent, and no /llms.txt, /ai-info or /for-ai path appeared in the 40-URL site map taken for this vendor and saved at .firecrawl/vendors/foxit-smart-redact/urls.txt. Paths under /ai/ on this site are ordinary product pages.
Ask: Do you publish any page, file or markup that tells AI assistants or crawlers how to describe Foxit products, and if so where?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Authority to send client material to the service
Not confirmed
No document read states what authority a firm needs before sending client documents to Smart Redact. The privacy policy gives 'your consent' as the legal basis for processing files uploaded to Foxit cloud services. The AI Assistant Security Overview places the determination on the customer: 'Customers remain responsible for determining whether their intended content and processing path are permitted by applicable law, organizational policy, and contract.' Because the FAQ states files are processed in the cloud and no hosting region is published for Smart Redact, a firm cannot tell from published material whether the document crosses a border, which is what an Australian Privacy Principle 8 disclosure turns on.
Ask: For a document sent to Smart Redact from Australia, which countries does it pass through or rest in, so that we can make an accurate cross-border disclosure to clients?
Model and model provider
Public claim only
No foundation model, model family or model provider is named for Smart Redact on any page read. The product page states only that it is 'Built on Azure' and 'Hosted on Azure', which are hosting statements. Foxit does name providers for its other AI surfaces: the AI pricing page states that Workspace lets users switch between 'OpenAI GPT and Google Gemini', that 'The AI Assistant in Foxit PDF Editor and Foxit PDF Reader runs on Microsoft Azure AI services', and that Local AI 'uses on-device models delivered through Microsoft Foundry Local'. Clause 1.2 of the General Terms of Service requires users of AI features to 'abide by all the applicable policies and documentations of Azure AI services'. None of those statements is made about Smart Redact and none is recorded here as a fact about it.
Ask: Which model performs the detection in Smart Redact, who operates it, is it a Foxit-trained model or a third-party service, and will you name it in the contract?
Subprocessors
Public claim only
No subprocessor list or disclosure for Smart Redact was found. The Trust Center, read on 2026-09-27, publishes certifications and security statements but no subprocessor register and no link to one. The AI Assistant Security Overview publishes a provider table naming Microsoft Azure ('Managed AI model services and document-processing capabilities'), Google Cloud Platform ('Managed AI model services used by applicable Workspace workflows'), Exa ('Web-search capabilities') and Amazon Web Services ('Cloud infrastructure used to host applicable Foxit account, administration, Workspace services, storage, and operational data'); that table is scoped to AI Assistant and Workspace and does not name Smart Redact. The Overview itself states that 'subprocessor disclosures' are 'governed by the relevant customer agreement, data processing agreement, privacy notice, subprocessor disclosure, or deployment-specific documentation', none of which is published on the pages read.
Ask: Where is the subprocessor list that applies to Smart Redact, will you provide it as a contractual annexe, and will you notify us before adding a subprocessor?
Training on customer content
Public claim only
The AI Assistant Security Overview states that 'Foxit does not, and will not authorize or instruct its subprocessors to, use customer documents, prompts, AI outputs, or other customer content submitted to or processed through the products on the customer's behalf to train or fine-tune any artificial intelligence or machine learning model, unless the customer has expressly authorized that use.' That document names its scope as AI Assistant in PDF Editor, integrated Editor AI features and Foxit Workspace, does not name Smart Redact, and states that where it conflicts with a customer agreement, data processing agreement, privacy notice or subprocessor disclosure, 'the latter shall control'. Separately, clause 4.1 of the General Terms of Service takes a licence to user content 'to use, reproduce, publicly display, distribute, modify, publicly perform, and translate the content as needed in response to user driven actions ... and for the purpose of operating and improving the Products and/or Services', and the privacy policy's no-training commitment is written for 'chat histories', not for uploaded documents.
Ask: Does the no-training commitment in the AI Assistant Security Overview cover documents sent to Smart Redact, and will you warrant it in our agreement rather than in a document that expressly yields to the agreement?
Use of corrections and feedback
Public claim only
Clause 4.1 of the General Terms of Service takes a 'non-exclusive, worldwide, royalty-free, sub-licensable, and transferrable license' to user content for, among other purposes, 'operating and improving the Products and/or Services'. The privacy policy states, for AI chat services, 'We process your chat histories to provide and maintain chat service and to improve AI accuracy and functionality' and 'We will not use your chat histories to train or improve AI models unless you have given us explicit consent'. The AI Assistant Security Overview states that product analytics and telemetry 'are separate from the substantive content of AI interactions'. Nothing read states whether a user's edits to Smart Redact's proposed redactions — the items a reviewer adds or removes — are transmitted to Foxit or retained.
Ask: When a reviewer removes or adds a proposed redaction in Smart Redact, is that correction sent to Foxit, and can it be turned off?
Retention of documents and outputs
Public claim only
The privacy policy states that files uploaded to Foxit cloud services 'are stored on an appropriate server infrastructure for processing' and that 'Unless you choose to store the files and data on a Foxit server for later usage, all these files you uploaded will be deleted once the process is completed, and the output files will typically be deleted in one day', with 'No backups ... of any transitional uploaded files or their processed output'. The Smart Redact FAQ states that 'Once redaction is finished, all files are automatically deleted, ensuring they are no longer accessible.' The AI Assistant Security Overview describes cloud request data as following a 'Temporary processing lifecycle' whose 'exact interval is defined by applicable product, privacy, contractual, or deployment-specific documentation' — no interval is published. The privacy policy separately retains 'personal data related to contract and business transactions ... for ten years from the last year of the business relationship'.
Ask: State the maximum retention period in hours for a document and its redacted output in the Smart Redact pipeline, including logs, caches and the detection service's own copies, and put it in the contract.
Deletion on request and on exit
Public claim only
The Smart Redact FAQ states files are 'automatically deleted' once redaction finishes. Clause 2.2 of the General Terms of Service states 'You are solely responsible for deleting your account along with the related account data. You will not be able to access any data or file after the termination of account.' The privacy policy states that on a request to remove an account, Foxit 'will delete personal data related to your account', with the ten-year retention for contract and business transaction data as the exception. No customer-initiated deletion control, deletion confirmation, or certificate of destruction is described for an individual document sent to Smart Redact, and no deletion path is described for saved redaction profiles.
Ask: How do we ask for immediate deletion of a specific document from the Smart Redact pipeline, and will you provide written confirmation that it and its derived copies are gone?
Human access to customer documents
Public claim only
The privacy policy states, of files uploaded to Foxit cloud services, 'During that time, we neither look at the files nor mine any data from them' and 'No backups are made of any transitional uploaded files or their processed output, and the content of such files are not monitored without your explicit permission.' The AI Assistant Security Overview states that stored product data 'is protected through technical and organizational safeguards intended to limit access to authorized users, services, and personnel'. Neither statement is made specifically about Smart Redact, and no support-access, break-glass or administrative-access process is described, nor any log a customer can inspect.
Ask: Can Foxit personnel or a subprocessor access a document while it is in the Smart Redact pipeline, under what authorisation, and is that access logged and available to us?
Access control and administration
Public claim only
The Trust Center states that Foxit applies 'role-based access controls' and describes 'Granular admin controls, including user role management, document-level permissions, and configurable access policies'. The AI Assistant Security Overview states that Foxit Workspace 'uses Foxit account authentication for protected product functions' and that administration options 'depend on the applicable product, account type, deployment, and customer agreement'. The AI pricing page describes the Foxit Admin Console for administering licences and pooled credits. No single sign-on, multi-factor authentication, SCIM provisioning or conditional access statement was found for Smart Redact, and no control for restricting which users may invoke it is described.
Ask: Can an administrator restrict which Foxit PDF Editor+ users may invoke Smart Redact, and does the account used for it support single sign-on and enforced multi-factor authentication?
Encryption
Public claim only
The Smart Redact FAQ states the feature is 'Hosted on Azure and safeguarded with AES-256 encryption' and that 'all data transmissions between the Foxit cloud and our PDF Editor are fully protected'. The Trust Center states Foxit 'applies AES 256-bit encryption' and enforces 'encryption for data in transit'. The privacy policy describes SSL with '256-bit encryption' for account access. The AI Assistant Security Overview states Foxit 'uses encrypted network transport' and that stored product data is protected by 'technical and organizational safeguards'. No page read states that documents are encrypted at rest inside the Smart Redact pipeline, and no customer-managed or customer-held key option is described.
Ask: Is a document encrypted at rest while it sits in the Smart Redact pipeline, with which algorithm, and is a customer-managed key available?
Assurance certifications
Public claim only
The Trust Center certification list, read on 2026-09-27, records SOC 2 (Type 2) against 'PDF Editor, eSign Business, eSign Essentials'; TAA Compliance and Section 508 Compliance against 'PDF Editor'; a VPAT self-assessment and ADA statement for PDF Editor; 'GDPR Support'; 'HIPAA Ready', stating Foxit is 'prepared to enter into a Business Associate Agreement'; 21 CFR Part 11 support and QES support for eSign Business; and FINRA support. No ISO/IEC 27001 and no ISO/IEC 42001 appears in the list. No audit report, certificate or bridge letter is published or linked, and the list carries a 'Show More' control, so more entries may exist than were rendered. The Smart Redact page separately asserts 'TAA compliance and SOC2 certification' for the feature without naming the audit scope or linking a report.
Ask: Will you provide the SOC 2 Type 2 report and its system description, and does its scope boundary include the Smart Redact cloud service or only Foxit PDF Editor?
Contracting entity and contract structure
Public claim only
The General Terms of Service, effective 27 June 2025, are 'a legal agreement between you, or an entity you are acting on behalf of, and Foxit Software Incorporated and its authorized affiliates'; no affiliate is named. Clause 14.1 applies the law of the State of California and gives exclusive venue to 'the federal or state courts located in San Jose, California'. Clause 9 limits total liability to 'the amount actually received by Foxit from you for the Products and/or Services' and clause 8 supplies the products 'AS IS' with no warranty. Clause 1.2 provides that third-party products and services 'including plug-ins and extensions' are not Products or Services under the agreement and that their use 'is solely between you and the third party'; the Smart Redact product page carries the label 'plug-in'. No Australian contracting entity, Australian address, ACN or ABN appears in the terms or in the privacy policy, whose responsible body is Foxit Software Inc. of Fremont, California, with Foxit Europe GmbH in Berlin named for European data protection questions. No data processing agreement is published or linked on any page read.
Ask: Which legal entity will contract with us for Australian supply, with its ACN or ABN, is Smart Redact a Foxit Product or a third-party plug-in under clause 1.2, and will you execute an Australian-law data processing agreement?
Cross-border transfers and data location
Public claim only
The privacy policy states 'The servers on which user data is collected, stored and used are located in the United States, Germany, Canada, Australia, and Japan' and that 'For customers from the European Economic Area, the UK, Switzerland, Canada, Australia, or Japan, your information will be stored on the local server, except for the account information (Email Address and password), which is currently located in the United States.' It also states that by using the products the customer allows Foxit 'to transmit, store and process your information in the United States, Germany and possibly in other countries'. The AI Assistant Security Overview states that 'Available regional service instances may include the United States, Canada, Australia, the European Union, and Japan', that 'not every provider or service is available in every Foxit region', and that 'A globally available service or endpoint does not, by itself, mean that data remains in the customer's assigned region.' Neither document names Smart Redact, and the Smart Redact page names no region at all.
Ask: Is the Smart Redact cloud service one of the workloads that runs in the Australian regional instance, and if any part of the detection runs outside Australia, which part and where?
Security incident notification
Not confirmed
No incident or breach notification commitment was found. The General Terms of Service contain no notification clause; the privacy policy describes security measures and data subject rights but no breach notification undertaking; the Trust Center describes daily backups, auto-scaling and 'geographically distributed disaster recovery systems' but no notification obligation. The footer of the pages read links a Security Advisories page and a Responsible Disclosure Policy, neither of which was read within the operation budget for this product.
Ask: Within how many hours of becoming aware of an incident affecting documents sent to Smart Redact will you notify us, in what form, and will that undertaking be contractual?
Changes to terms, price and the service
Public claim only
Clause 1.3 of the General Terms of Service provides that Foxit 'may make changes to the Agreement from time to time', that notice may be given by 'revising the date at the top of the Agreement', that 'Unless otherwise specified, the amended terms shall be effective immediately', and that continued use confirms acceptance. Clause 6.2 allows Foxit to 'adjust or reset the pricing of any or all Products and Services' at its sole discretion, with notice and an option to cancel before the next renewal term, and subscriptions renew automatically until cancelled. Clause 13 reserves the right to discontinue development and support of any product at any time, subject to not discontinuing support during the current annual term of a support agreement. The AI Assistant Security Overview states that 'Feature availability and processing paths vary by release, platform, location, account, configuration, and entitlement.'
Ask: Will you give us advance written notice of a change to the Smart Redact processing path, provider or region, rather than relying on a revised date at the top of the terms?
Exit, export and continuity
Public claim only
Clause 2.2 of the General Terms of Service states that on account termination 'You will not be able to access any data or file after the termination of account', and clause 10.2 allows Foxit to terminate or suspend access 'without refunds for any pre-paid fees' in its sole discretion on breach, non-payment, illegality, or where 'Foxit elects to discontinue or modify the Products and/or Services'. The privacy policy retains contract and business transaction data for ten years from the last year of the business relationship. No export or portability mechanism is described for saved redaction profiles or for any Smart Redact configuration, and unused document quota is not addressed on the pricing or product pages.
Ask: On exit, can we export our saved redaction profiles, what happens to unused document quota, and how long do we have to retrieve anything held in the Foxit cloud?
Connectors and outbound integrations
Public claim only
The privacy policy names the third-party document management systems for which Foxit collects token information, including SharePoint, NetDocuments, iManage Work, iManage Cloud, Egnyte, OpenText Documentum, OpenText eDOCS, OpenText Content Suite, Worldox and FileOpen, and states the list may change. The AI Assistant Security Overview describes Connectors in Foxit PDF Editor and Foxit Workspace Desktop, states that 'Connectors are explicitly configured, tool calls are surfaced in the product experience, and selected operations can require user approval', and that access is limited to the scopes and credentials the customer authorises; it names Notion and Atlassian as examples on the pricing page. Neither statement is made about Smart Redact, and the Smart Redact page describes no connector of its own.
Ask: Does Smart Redact make any outbound call other than to the Foxit cloud redaction service, and can connectors be disabled tenancy-wide while Smart Redact continues to work?
Web access from the product
Public claim only
The AI Assistant Security Overview lists 'Image generation, web search, and other services identified as cloud-only in the applicable release' as cloud-only capabilities, and its provider table names Exa for 'Web-search capabilities used when a user invokes a feature requiring current public-web information'. Those statements are made about AI Assistant and Workspace. The Smart Redact product page describes no web search, no retrieval and no external lookup: the published function operates on the document supplied. Nothing read states whether the Smart Redact pipeline makes any outbound request beyond the Foxit cloud service.
Ask: Does the Smart Redact detection path make any web or external lookup, and can web search be disabled for our tenancy without affecting Smart Redact?
Control over what the tool changes
Public claim only
The product FAQ states 'Smart Redact gives you a full preview of suggested redactions before anything is applied. You can review, edit, or remove items — so you stay in control of what gets blacked out.' The page describes the result as permanent removal, including of hidden content and metadata, once applied, and describes reusable redaction profiles for repeated workflows. Nothing read states whether the preview step can be bypassed, whether a profile can be set to apply redactions without review, or whether an administrator can require review.
Ask: Can the preview and review step be bypassed by a user or by a saved profile, and can an administrator make review mandatory for every redaction?
Human review obligations
Public claim only
Clause 4.3 of the General Terms of Service provides that, given 'the probabilistic nature of machine learning', using AI features 'may, in some situations, result in incorrect Output', that 'You shall evaluate the accuracy of any Output as appropriate for your use case, including by using a human review of the Output', and that if the customer suffers loss from using the output 'you shall be solely responsible, and Foxit shall not assume any responsibility or loss'. The AI Assistant Security Overview states that output 'can be incomplete, inaccurate, biased, or ungrounded', that users 'should verify material outputs against the source document', and that the products are 'not intended to make decisions about individuals that produce legal or similarly significant effects without meaningful human review'. Those obligations sit beside the accuracy figures published on the Smart Redact page, which the page states inconsistently as 99% in two places and 99.9% in a third.
Ask: Given clause 4.3 places accuracy evaluation on us, what review method do you recommend for a redaction set before disclosure, and what does the published accuracy figure mean for the volume of pages a reviewer must still check?
