Skip to content
Docs/Architecture
REDAX / ARCHITECTURE

Architecture

A small service with an explicit privacy boundary: request, policy, detection, replacement, and audit.

WHYKeep raw customer text outside the model boundary.
WHATA local API that detects, replaces, and records safely.
HOWRun it, send text, pass only returned text onward.

One boundary, five stages

Redax runs next to your application. The API receives a request, applies a versioned policy, runs deterministic patterns first, optionally calls a local encoder, fuses overlapping spans, replaces selected spans, then writes only redaction metadata to the audit log.

client → POST /v1/redact → policy → regex + model → consensus
       → typed replacement → safe text + spans + keyed digest
                                      ↘ audit metadata only

Operational surfaces

/healthz
Liveness
/readyz
Readiness
/metrics
Prometheus
OTLP
OpenTelemetry traces

What happens to one request

  1. 1. AuthenticateThe API key is checked when authentication is configured.
  2. 2. AdmitRate limits, request size, timeouts, and job capacity protect the service.
  3. 3. DetectThe configured regex and model detectors produce candidate spans.
  4. 4. ApplyOffsets are validated, overlaps are resolved, and the policy chooses the replacement.
  5. 5. RecordThe audit backend writes counts, types, duration, and request metadata—never values.
  6. 6. RespondThe client receives safe text, spans, a keyed digest, and request correlation data.

Why the pieces are separate

Detection answers “where is sensitive text?” Policy answers “what should happen to it?” Replacement answers “what can the next system safely see?” Audit answers “how can we prove what happened without storing the secret?” Keeping those decisions separate makes a change reviewable and lets operators replace a detector without changing the privacy contract.

What is deliberately absent

The default model path does not call a hosted inference service. Redax does not promise that surrounding infrastructure is silent: configure your proxy, Redis, audit storage, model cache, and telemetry exporter as part of the deployment boundary you operate.