Why a receipt matters
Most privacy tools ask you to trust them. Scrub asks you to verify it.
Every time Scrub cleans a file, it generates a receipt — a structured log of what was removed, what was kept, and where the residue lived. You can read it before you send the file. You can save it as an audit trail. You can compare against exiftool and pdfinfo and confirm the numbers match.
This sounds like a small thing. It isn’t. It’s the reason Scrub exists.
Why redaction by rasterisation
A black rectangle drawn on top of text isn’t redaction; it’s a sticker. The text is still there in the PDF. Anyone with Preview and a marquee selector can pull it out in five seconds.
Scrub rasterises the affected region — turns it back into pixels — so there’s nothing underneath. The same approach that Acrobat’s enterprise tier uses, applied to a tool that costs less than a single month of Acrobat.
The network manifest
Below the features grid on this page you’ll find Scrub’s full network manifest: every domain Scrub is ever allowed to talk to, what each rule does, and which channel it applies to. The list is short on purpose. We sign it. We publish it. We don’t change it without a release note.
If you’d like to verify it for yourself: run Scrub behind Little Snitch for a week and compare. If you see a connection that isn’t on the manifest, that’s a bug — file it and we’ll fix it.