Faces, logos and signatures: anonymizing documents and images

Most conversations about anonymization focus on text: names in messages, email addresses in headers, phone numbers in signatures. But a company archive is full of things that are not plain text. Scanned contracts, PDF invoices, slide decks, screenshots attached to tickets and photos from team events all carry identity in ways a text filter will never see.

That is why images and documents get their own treatment. Faces, logos and signatures are blacked out, the text inside documents is tokenized like text anywhere else, and the work content that makes the file useful is left in place.

A name typed in a Slack message is easy to find. The same name printed in the header of a scanned purchase order, or visible in a screenshot of a video call, is not. Visual content hides identity in pixels, layout and handwriting, and those do not respond to the same techniques as text.

Visual files are also everywhere once you look. A typical archive might include:

• Screenshots attached to bug reports and support tickets
• Slide decks for board meetings, sales pitches and all-hands updates
• Scanned or e-signed contracts, statements of work and NDAs
• PDF invoices, receipts and purchase orders
• Profile pictures in chat, CRM and project tools
• Photos from offsites, events and whiteboard sessions

Dropping all of these would be the easy answer, and it would throw away a lot of real work. A screenshot of an error is often the most precise description of a bug in the whole ticket. An architecture diagram in a deck can explain a system better than ten pages of docs. The goal is to remove what identifies people and companies while keeping what shows how the work was done.

Faces are the most direct identifier in any image. They appear in profile photos, screenshots of video calls, event photos, recorded demos and, occasionally, scanned identity documents.

Every face in an image or PDF is blacked out. That applies whether the person is an employee, a customer, a contractor or someone in the background of an office photo. There is no attempt to judge whose face matters; if it is a face, it goes.

Some files never reach this step at all. Government IDs are removed outright, and HR, payroll and medical folders are excluded by default. A scanned passport sitting in an onboarding folder is out of scope before anonymization begins.

Logos are easy to overlook because they do not feel personal. But a logo identifies a company as clearly as its name does, and the archive is full of other companies: customers on invoices, vendors on quotes, partners on co-branded decks, and the seller's own brand on nearly every template.

In text, company names become consistent tokens, so the customer behind COMPANY_031 is the same customer in every email, ticket and CRM record. Logos in images and PDFs are blacked out for the same reason. A dataset that tokenized every company name but left logos visible on every invoice would undo its own work.

The same applies to logos that show up incidentally, such as a customer's brand in the corner of a screenshot or a vendor's mark on a shared spreadsheet template. This matters most for sellers with confidentiality obligations to clients. Even if a client is not excluded entirely, nobody downstream should be able to tell who they were from a letterhead.

Signatures turn up on contracts, approvals, expense forms, offer letters and the occasional scanned note. A signature identifies a person, and in the wrong hands it could be misused. It has no training value that is worth that risk.

Signatures in images and PDFs are blacked out. The surrounding document stays: the clauses, the dates, the structure of the agreement. The printed name under the signature line is tokenized like any other name, so a contract signed by PERSON_007 can still be connected to the emails in which PERSON_007 negotiated it.

That connection is the point. A licence agreement, its negotiation thread and the tickets that implemented it together tell a story an agent can learn from. None of that story depends on what the signature looked like.

Blacking out faces, logos and signatures is narrow by design. Charts, tables, diagrams, code in screenshots, error messages and handwritten notes on a whiteboard stay, with any names, emails or account numbers in their text handled the same way as text elsewhere. Credentials, API keys and card numbers visible in a screenshot are removed outright, just as they would be in a message. For more on that, see tokenization vs. redaction.

Before anything is delivered, you review an anonymized sample, and that sample includes documents and images. It is worth paying attention to the files a filter is most likely to miss: photos taken at an angle, low-resolution scans, logos used as small watermarks, and initials written by hand. If something slipped through, you flag it and it gets fixed before sign-off.

No third party touches raw data at any point. Anonymization happens in-house, and the raw archive is deleted within 30 days of sign-off as a contract obligation, with a deletion certificate to confirm it.

If your company's records include a lot of scanned paperwork, decks or image-heavy tickets, that is worth raising early. It helps us plan the review and gives you a chance to set exclusions for anything you would rather keep out entirely. You can read more about the pipeline on our trust page.

When you are ready to talk about scope, book a 15-minute call.