Under Seal finds every name, SIN, business number, account, diagnosis, address and hidden comment in a client file, from engagement letters to T1 and T2 returns and notices of assessment, then rebuilds the document clean. You can hand it to a colleague, an expert or an AI model without a second thought. Everything happens on your own device.
Court filings have been released with "redacted" passages that anyone could copy and paste from under the black box. A drawn rectangle hides text. It doesn't remove it. Under Seal removes the text and rebuilds the document from scratch.
Tracked deletions with the client's bottom line. A comment that says "don't send Schedule B." A hidden sheet of private notes. Speaker notes. The author's name. Under Seal's X-ray shows you all of it before anything leaves your hands.
Pasting a client file into a chatbot can breach privilege, PIPEDA or your professional code. Banning AI only pushes the same behaviour out of sight. Under Seal gives your team a safe way to say yes.
PDF, Word, Excel, PowerPoint, CSV, email or pasted text. One file or a whole matter.
Every finding is highlighted by type and confidence, alongside hidden metadata, comments, revisions and notes.
Click to keep or remove. Add a watch-list of client names. Pick a policy: Legal, CPA, Advisory, Health, HR.
Export a clean Word, PDF, Excel, CSV or AI-ready Markdown file, plus a Certificate of Sanitization.
Paste the AI's answer back in. Under Seal puts the real names back on your device, using your encrypted vault key.
[PERSON-1]'s claim, but it never learns who she is.Tracked deletions and insertions · comments and their authors · hidden text · headers and footers · document properties and custom properties · revision fingerprints · hidden and very-hidden sheets · cell comments · formulas · hidden rows and columns · speaker notes · hidden slides · PDF annotations and form fields · embedded files · email routing IPs and technical headers · attachments.
Under Seal is a web app that behaves like desktop software. Your documents are opened by your browser, processed in memory, and saved back to your own disk. The app's security policy allows it to contact exactly one address: the licence service. The service rejects any message containing more than the five fields shown here, so even a bug couldn't send a document.
# the app's Content-Security-Policy connect-src'self'https://underseal-activation-production.up.railway.app; # licence check-ins only form-action'none'; # no form posts default-src'self'; object-src'none'; # a complete check-in, exactly as sent { "licence_id": "lic_3f9a0c41d2e87b65", "install_id": "6f1c2a3b-4d5e-4f60-8a7b-9c0d1e2f3a4b", "app_version": "1.3.0", "period_key": "M2027-04", "docs": 37 }
Strip parties, matter numbers, settlement figures and medical history before you use AI on a claim, brief an expert, or circulate a precedent. Profile: Legal.
Try the litigation letter →T1s, T2s, notices of assessment, slips and planning memos. Every identifier comes out and the line amounts stay, so AI can still check the math or draft the response to CRA. Profile: Tax.
Try a fillable T2 → · an NOA →Client books, KYC sheets and beneficiary lists, scrubbed column by column, including the hidden "Notes" sheet. Profile: Advisory.
Try the client book →Accommodation requests, medical notes and complaints, shareable with counsel or an AI drafting assistant. Profile: HR.
Try the HR email →Code names, targets, people and the speaker notes you forgot were there. Profile: General.
Try the board deck →The strictest policy: health numbers, conditions and every date removed or shifted. Profile: Health.
Open Under Seal →Every document counts once, whatever its length: a two-page notice and a ninety-page T2 package are each one document. Evaluations are arranged privately. Prices in Canadian dollars, or the same amounts in US dollars for US firms, plus applicable tax. Your documents never touch our servers on any plan.
No. Files are read and rebuilt inside your browser. The only network traffic is a short licence check-in to one address, carrying counts only. To check, open your browser's developer tools on the Network tab and process a file, or use "Show what Under Seal sends" in the app. Our regression tests also fail on any request that isn't a published check-in.
Three messages, with these fields and no others:
| Activate | activation code · random installation ID · app version · optional computer name |
|---|---|
| Check-in | licence ID · installation ID · app version · period · this computer's document count for the period |
| Release | licence ID · installation ID |
It never sends document content, file names, sizes, hashes, findings, user names or hardware identifiers. The service rejects any message with an extra field. Full details are in the security note.
It removes the identifying details that make most AI use risky, and documents what was removed. Compliance still depends on your firm's policy, your engagement terms and professional judgment. The certificate records a named reviewer for that reason.
Scanned images with no text layer (on-device OCR is on the roadmap), handwriting, photos, and details that are only identifying in context ("the only female partner in our Kelowna office"). Under Seal flags image-only pages and lower-confidence findings, and you can add anything it misses to the watch-list in one click.
Structure survives: headings, lists, tables, sheets and slides. Fonts, images and layout quirks don't, on purpose. Rebuilding from text is what guarantees that metadata, revisions and hidden objects can't come along.
All of them: ChatGPT, Claude, Copilot, Gemini, or your firm's private model. The AI-ready export tells the model to keep placeholders intact, and Restore tolerates common reformatting such as PERSON 1 or [PERSON-1].
One file processed, whatever its length. A two-page notice of assessment and a ninety-page T2 package are each one document. Your tier sets the monthly allowance; when you reach it, Under Seal asks you to move up a tier before processing more.
On annual terms, nothing changes: you draw on a 12-month pool, so April can take as much as it needs. On monthly terms, Under Seal warns you at 75% with a projected run-out date. If you reach the limit, it offers three options on the spot: move up a tier, add a priced tax-season increase for the period, or switch to annual terms. Waiting files stay in the queue and are processed as soon as the change is recorded. Nothing is lost.
Each computer reports a single number, how many documents it processed this period, and the licence service adds them up across your firm. Each computer may process its share of what's left before it checks in again, so the allowance holds even when some are offline. No file names or content are involved at any point.
Yes: T1 and T2 returns (including Schedule 50 shareholders and Schedule 9 related corporations), T3, slips, NOAs and reassessments, GST/HST and Revenu Québec filings, and US forms. Fillable PDFs are handled properly, because their values live in form fields rather than the page text. Dynamic XFA forms need a "Print to PDF" first, and Under Seal tells you when.
Tokens give consistent, reversible placeholders, best for AI. Synthetic uses realistic fictional names, shifted dates and format-preserving IDs, so the document still reads naturally. These IDs deliberately fail their checksums, so no fake can pass for real. Redact means black bars with no way back.