The brief for IT & InfoSec reviewers

What it is

A local desktop application for Windows that removes people's names and identifying numbers from legal documents on the user's machine, so the redacted copy — not the original — can be pasted into an AI service or shared externally. There is no account and no server of ours; the app runs two local services of its own, on the loopback address only (below). It is licensed Apache-2.0, © Simpler Terminal Value Systems Pte Ltd. This page exists to give your existing software-review process what it will ask for — not to argue you should skip that process. If your organization routes tools that touch regulated data (MNPI, NPI, PHI) through third-party or AI-governance review, that review still applies; this page describes the software's behavior, not your data-handling policy.

Network behavior

The two local services, and who may use them

Loopback ports belong to the machine, not to one user. On a shared Windows host (Remote Desktop, Citrix) another signed-in account could bind port 1436 or 49400 before the app does and wait for documents. Until 2026-09-23 the app would have sent it the unredacted text. It now establishes who is on each port before any document text leaves its process.

Endpoint requirements

Application control (AppLocker / WDAC / MDM)

A per-user install answers elevation, not allowlisting. If your endpoints run application control, the app needs rules:

• Publisher rule: not available — nothing is code-signed, so there is no publisher name or certificate thumbprint to write a rule against. Use hash rules against the release you deploy or a build you produced.
• What runs: the app's own executable; node.exe beside it, which runs the engine service and its pipeline stages; cmd.exe running engine\tools\launch-server.cmd; and llama\llama-server.exe. Blocking cmd.exe or llama-server.exe stops the model from starting. Blocking node.exe stops the engine service, and stops the model too, because the launcher uses node.exe to find and hash-check the model file — unless the SIMPLER_MODEL_GGUF environment variable names the model file, in which case the app hash-checks it itself, starts the model, and documents go to the lighter in-app engine. With no model, the app marks the document "Read, not redacted" and does not redact it: it masks only the user's always-redact list and the safety-net patterns for structured identifiers (phone numbers, emails and the like), and the rest is left to the user to select by hand. The in-app engine, on which none of the published numbers was measured, runs when the model server is up and the engine service is absent, refused, or fails on a document; the screen and the receipt name it.
• Install path: by default %LOCALAPPDATA%\simpler.legal, the per-user folder Tauri's installer names after the product; its setup program shows a folder page where the user can choose another, so read the path from the machine. This is read from Tauri's installer template; no install has been captured.

Verify it yourself — don't take this page's word

• Airplane test: disable networking and redact a document. By the code, everything should work, because every call the app makes is to this machine. No recorded run of this test is on file.
• Wire audit: run a network monitor (Wireshark, or Windows' own pktmon or Resource Monitor) during a redaction. By the code you should see only loopback traffic to 127.0.0.1: ports 1436 and 49400, and the relay's port, which changes at each launch. No capture is on record. This is the check that does not depend on the app's own reporting: the app's in-window record counts only its window, not its background workers, its Rust side or other processes, and says so.
• Port audit: netstat -ano shows which process holds 1436 and 49400; the app sends text to 1436 only after its holder proves it has the launch's token, and refuses a 49400 holder under another Windows account, SYSTEM, or a process it may not inspect.
• Source audit: the window's requests go through one file, app/frontend/src/lib/tauri.ts; in the packaged app they become commands in app/src-tauri/src/engine.rs, which reaches 127.0.0.1:1436 and 127.0.0.1:49400 only. The pipeline's stages reach the model through the app's relay (app/src-tauri/src/relay.rs). There is no model download to audit. The other http:// strings in the app's source code (app/frontend/src, app/src-tauri/src) name four hosts, schemas.openxmlformats.org, schemas.microsoft.com, purl.org and www.w3.org: they are the addresses of the XML namespaces Word and Office files use, which the .docx writer and its check recognise, and examples of such addresses in the text of the .docx receipt. None of them is requested. Outside comments, the app's source code in those two folders holds one https:// address: Google's address for the model file, which the Setup and Settings screens show as text for you to copy. The app never requests it.
• Artifact audit: the installer is unsigned, so take its SHA-256 yourself from the copy you reviewed, check it against the one published beside the release (its .sha256 file) and in README.md, and allowlist that hash. The model pin is in locate-model.mjs and in the app.
• Accuracy audit: the benchmark's draw manifests, gold labels (as character offsets), scorer and result boards are in the repository; the documents themselves re-fetch from public sources, and one court's gold is withheld. The measurement record is at simpler.legal/research.

What files it reads, and what the .docx check cannot see

Simpler Legal never draws boxes over your document. Everything it redacts is deleted from the text and substituted with a placeholder, and a text export is a new file rebuilt from the cleaned text. A .docx export is not: it rewrites your original Word package, so its safety rests on a check rather than on impossibility — the finished file is walked again, and if the check finds a name the engine found or a term from your always-redact list still in it, the export is held back. The check has blind spots, listed below. A name the engine never found, in the body or in the headers, footers and notes it reads apart from the body, is in no table, so the check cannot catch it unless the name is on your always-redact list. A name run into a plain word of letters where nothing marks both its ends is a second: kestrelholdings where the list says Kestrel, or tanholdings where the table says Tan, is not masked in the text export or in the .docx, and the check passes. So is a name typed with its letters spaced apart. Word's hidden places are a third: a name split between separate parts of an equation, such as a fraction's top and bottom, ships, and the check passes. Tags follow spellings, not people: a different form of the same person's name, such as a surname alone or a possessive, can get a tag of its own, so the AI you hand the document to may read one person as two. The reverse happens too. Some names are replaced by a bare, unnumbered [Person] that does not tell people apart: on the benchmark's 25 court judgments, one [Person] stood for two or more differently spelled names in 15 (in none of its 46 agreements). And one spelling can carry two tags: in 9 of those 71 documents a name was tagged as a company in one place and a person in another, or as two different people. A table row can also reach into a different, longer name: with Donald in the table, McDonald becomes Mc[Person1], and the two read as one. Across separate documents of one matter the tags are not coordinated either: the same person can carry a different tag in each file. The map from tags back to names is a separate file that never exports with the document unless you explicitly say so.

What files does it read?

PDF, Word (.docx) and plain text. Scanned or image-only pages need OCR, which isn't included yet — we'd rather tell you that plainly than silently guess at a page. A PDF with no readable page is held; a scanned page inside an otherwise readable PDF is left out, and the copy carries a line in its place ([page 7 is not included: this app could not read it]). A saved email, or a file whose text carries an email's headers or encoded content such as a base64 attachment, is held before the engine reads it, because the app cannot read what is encoded and so cannot mask it; the hold says how to get through (save the message body as text or PDF, and each attachment as its own file). In a PDF, only the page that carries such a block is left out, marked the same way, and the other pages are read. Not every encoding is caught: ASCII85, for one, goes through unread, and so does a base64 run short enough, or shaped enough like a column of ids, to pass for one. A file is held when a run of characters written as % and two hexadecimal digits spells two or more plain Latin letters or digits, or, outside a web link or a file path, two or more letters of another script such as Chinese; an escaped space or punctuation mark, an escaped accented letter, and escaped letters of another script inside a link or a path go through on one line, except in a file name with a bare comma or semicolon in it, which is held, and a name written that way is masked in both exports, the escapes with it (see below); printed across rows, such a link can still be held.

A text export is a new file rebuilt from the redacted text — never your original with boxes drawn on it. A .docx export is different: it rewrites your original Word package, and its safety rests on a check rather than on impossibility. The finished file is read again: every part and the part's name, its text, every attribute value, the names of its elements and attributes (in the parts Word writes, not a name under one of Office's own namespaces), and the namespaces it declares or lists. It is held back if the check finds a name from the review table or a term from your always-redact list still in it, with its words apart or run together, or something the safety-net pattern masks. The check has blind spots, stated plainly here. The receipt states what the check reads and what it does not, and names the blind spots below that concern the check itself: a name split between the parts of an equation; a name with its letters spaced apart or each in brackets, with a hyphen, a line break or an invisible direction or format mark inside one of its words, broken across the lines of a quoted reply, or with a letter written as a symbol in the Symbol font; a name run into a plain word of letters; a name under six letters inside an address or in a value in the file's code; a row masked inside a longer name; a row of digits alone under six digits inside a longer number or value, or grouped other than by the marks it lists; a character reference without its semicolon (other than &nbsp and one by number), one HTML does not define, or one escaped again; a name under one of Office's own namespaces; and a number under one of Office's own prefixes or in a drawing's position, size or share of the page.

First, the engine reads the main body, and then, in a request of its own, the text the saved .docx carries outside it: headers (with any watermark), footers, footnotes, endnotes, chart and SmartArt text. A name it finds only there is masked wherever the saved .docx carries it, and the Review screen lists it; the copied text and the .txt are the body alone. If the body was read and that text was not, or its read could not be used, the .docx is held and says why. A name the engine did not find anywhere, and that is not on your always-redact list, is not masked anywhere in the file, and the check passes.

Second, a name or listed term run together with other words (KestrelCapital or kestrelcapital.com where the list says Kestrel, MargaretTan where the table says Margaret Tan) is masked in the text a reader sees, in the text export too, and holds the export wherever else the check finds it. In the text a reader sees, a name is found inside a longer word only where a break marks both its ends — a space or punctuation mark, letters meeting digits, a capital after a small letter — or before a plural ending when it is written with its capital (the Smiths where the table says Smith), or, from six letters and digits, inside a web or e-mail address, a path, a handle, a tag or a word with a digit in it (www.kestrelcorp.com, @kestrelholdings or #kestrelholdings where the list says Kestrel). Run into a plain word of letters where nothing marks both its ends, a name of any length ships, in the text export as well, and the check passes (kestrelholdings where the list says Kestrel, margarettanfile where the table says Margaret Tan, tanholdings or Tanholdings where it says Tan, LIWUCORP where it says Li Wu), and so does a name under six letters inside an address (tanholdings.com).

A row of digits alone, such as an account or matter number you add to the table, is found from six digits wherever they stand together, inside a longer number or a reference too (an IBAN that ends in it), and in the text a reader sees also across one mark that groups them: a space of any kind or a tab, a full stop, a middle dot or the bullet (•), a slash, a hyphen, a dash or the minus sign, a hyphen with a plain space either side (3192 - 6819), or a round closing bracket and one plain space after the first group, as (3192) 6819 is written; grouped any other way — with a comma (3192,6819), an underscore, a colon, two spaces, a line break, an en or em dash or a slash with a space either side (3192 – 6819, as a range is written), a square bracket ([3192] 6819), a no-break space beside a bracket or a hyphen, or a mark that only looks like one of those (a fraction slash, an ideographic or small full stop, a swung dash, a heavy minus sign, a white, black or triangular bullet: 3192⁄6819, 3192。6819, 3192◦6819) — it ships from both exports, and the check passes. A row of fewer than six digits, such as a five-digit matter number, is masked where it stands alone in the text, and holds the export where it is the whole of a value in the file's code that the check reads (in an add-in's attribute, in a part this app does not know, or between the tags of an element under one of Office's own namespaces); it is not looked for inside a longer number or value (9944179, or Matter 44179 as one value, where the table says 44179), in an attribute under one of Office's own prefixes (w:tel) or with no prefix on a drawn shape, or in a drawing's position, size or share of the page: there it ships, and the check passes.

A name written with percent-escapes, as a web link writes a space (Margaret%20Tan), an apostrophe, an accented letter (M%C3%BCller for Müller) or a Chinese name, or with a character reference typed out, with its semicolon or, for &nbsp and a reference by number, without it (Margaret Tan, Margaret&nbspTan, Margaret&#160Tan), is read as the characters it writes: it is masked in both exports, the escapes with it, and holds the export in the file's code. An escape that writes no character where a name could stand (Ren%E9%20Tan where the table says René Tan) holds both exports. Written as a mail gateway rewrites a link (Proofpoint's Ren*E9*20Tan or Ren-E9-20Tan), the same escape holds both exports too. A line break that a mail program's wrap put inside an escape, or inside a mail gateway's wrapping of a link, is read across where the link starts with a scheme (https://) or www., and the name is masked; in a link that starts with neither, or where the line after the break starts with a quote mark (>), as each line of a quoted reply does, a name broken that way ships from both exports, and so does a name with a line break inside its own letters (Marg and aret Tan on two lines), in a link or in prose.

The same rule can mask too much. A row is found in a longer name where a capital marks where it starts: with Donald in the table, McDonald becomes Mc[Person1]. And a row is found before a plural ending on a word written with its capital: with Law in the table, the Laws Committee becomes the [Person1]s Committee. And inside a tag, as inside an address or a handle, a row of six letters or more is found wherever it stands: with Porter in the table, #supporters becomes #sup[Person1]s. All three happen in the text export too, and the AI you hand the copy to may read someone else, or something else, as the person in your table. A name that ends in a short designator is found with the designator written out, and the whole word is masked with it: with Hickson Corp in the table, Hickson Corporation becomes [Company1], in the text export too.

Third, a Word file keeps names you never see on the page. The app gives every bookmark the author made a neutral name (bm1, bm2 and so on; the ones Word makes itself, for a table of contents or a cross-reference, keep theirs), does the same for every list and caption label the author named, and renames styles and fonts that carry a masked name. Internal links, page-number and footnote-number references and the table of contents follow the renamed bookmark and keep working, except that a table of contents whose entries are written as link fields keeps its page numbers but its entries stop being links; a cross-reference that shows a clause's number or text (Word's REF field), and a link written as a field code, become plain text and no longer update, and the save line and the receipt say so.

Measured on 2026-09-24, a name still ships, and the check passes, when its letters are spaced apart in the text or each written in brackets (M a r g a r e t T a n, ⒨⒜⒭⒢⒜⒭⒠⒯ ⒯⒜⒩), in the text export too; when a hyphen stands inside one of its words (Marga-ret Tan, as text copied from a PDF keeps a line's break), in the text export too; when an invisible mark that sets the direction or format of text stands inside one of its words (a left-to-right mark, as text pasted from a right-to-left document can carry), in the text export too; when it is written with a character reference that has lost its semicolon, other than &nbsp or one by number, that HTML does not define, or that was escaped again (Ren&eacute Tan, Margaret Tan, René Tan), in the text export too; when a letter of it is written as a symbol in the Symbol font, which Word draws as the Greek capital shaped like the Latin one (the A of Margaret TΑn), in the .docx; when it is split between separate parts of an equation, such as a fraction's top and bottom, a base and its superscript, or two cells of a matrix; when it is shorter than six letters and a program wrote it in lower case as a value in the code of one of Word's own parts (lee where the table says Lee); and when a program other than Word wrote it into one of the few places in the file's code that Word fills only with its own words.

A telephone or other number that the safety-net pattern masks in the text holds the export when an add-in wrote it into an attribute or an element of its own in one of Word's own parts, or when it is written as digits alone between the tags of an element under one of Office's own namespaces (<w14:tel>2125550147</w14:tel>), but is not found when a program wrote it into an attribute under one of Office's own prefixes (w:tel), into an attribute with no prefix on a drawn shape, or into a drawing's position, size or share of the page (<wp:posOffset>).

Fourth, a part of the file this app does not know, such as an add-in's, is kept only when what it holds reads as code — numbers, dates, ids, single code words, names Word looks up; anything typed in it, or a number the safety-net pattern would mask, holds the export. What is kept is read by the check for your table's names (a row of digits alone under six digits only where it is the whole of a value) and by the safety-net pattern, but a name that is not in your table is kept as written where it stands as a program writes code: in small letters, or starting with one and run together (whitfield, jonasWhitfield), as an attribute's value, and so at the end of a web address on a host Office's own addresses use (purl.org, www.w3.org) in an attribute; run together with digits between its tags (whitfield2291); in small letters, or so run together, as the name of an element, an attribute or a prefix; as the part's own file name; whatever it says, as the name of an element under one of Office's own namespaces; and, whatever it says, in the address of a namespace the part declares (urn:matters:Jonas Whitfield). When the export keeps such a part, the save line and the receipt carry the writer's note naming it, and the Review screen lists it under Warnings (“Unrecognized part not scanned”). If a part is named there, delete the object it belongs to or copy the document's text into a new blank document, and drop that copy instead.

Audit artifacts your users get

Every export can come with a redaction receipt. It records rows kept and left visible, tags placed, which safety-net tables ran, how many rows the user decided and how many stand as the engine marked them, whether the review was finished, a mask check, a check that none of the listed names is found in the export, a partial-name check, which engine ran (and whether a service or model server was started outside the app), and a network line counting requests off the machine as seen from the app's window, with what that count cannot see. Every line that concerns a name is a count: the receipt prints no name from the table, no always-redact term and no piece of either, apart from the fixed words of the .docx scope line, which are the same on every receipt whatever the table holds: examples such as KestrelCapital and XYZReport, the designators Co, Corp and Inc, and words such as Office and Dublin Core. A rule that looks for a client's name will match the receipt when the name shares one of those words. The names the user chose to leave readable are counted on it and listed in the name key, under "Left readable by your decision", each marked where it is boilerplate, on the always-redact list, or readable only in part. A piece of a listed name that may still be readable in the export (for example Hastings left behind by a masked Hastings Holdings Ltd) is counted on it and named only on the Export screen: printed beside the words "partial name", a piece would tell the reader which readable word belongs to a masked name. The partial-name check reads the copied text and the .txt, which stand for the body, and of a .docx export the text of every other part the writer saves (a header, a footer, a note, a chart, SmartArt), as saved; it does not read the file's code, nor the text Word keeps there as a setting (a watermark, the signer a signature line suggests, the text a list prints beside each number). It looks for each word of a masked row or a listed term from four letters, from two where both the name and the copy write it with a capital, or from four digits, and never inside a plain word of letters. It skips words too common to stand for a name alone (titles, designators, two-letter codes, the, and, for, of, and Bank, Road, Street, Place and Avenue) even where one is a surname, so Ms Street left in the copy is not flagged where the table says Della Street. Its line on the receipt says what it read, whatever it found. The original filename is withheld, because the receipt travels with the redacted copy. The name key, which maps tags back to names, is saved or copied only when the user asks, as a separate file whose name begins DO-NOT-SEND-namekey. For a .docx export the receipt also carries the writer's own notes: what it removed, what it renamed, what it wrote out as plain text (a cross-reference, for example), and any part of the file it did not know and kept. Whether the receipt satisfies a given regulator, court or file requirement is your professionals' judgment.

Plain-language regulatory framing (not legal advice)

• What leaves, and how: the app sends nothing to us — there is no vendor endpoint. The redacted copy the user then pastes into an AI service is a separate disclosure, governed by your agreements with that provider. That copy still carries the document's facts, dates, amounts and most places, by default the names of companies that are not the document's own identity, and anything the engine missed.
• HIPAA: a BAA covers vendors who receive PHI. This software sends us nothing; whether the AI provider needs one is a question about the redacted copy.
• GLBA / banking (OCC, FDIC): the tool is software under your existing endpoint controls and makes no connection off the endpoint by its code. Whether a redacted copy may go to an AI provider is your policy decision.
• SEC / Reg S-P (RIAs): the app keeps no history between sessions; saved receipts can support books-and-records practices if the user files them.
• Separate question: approving this app and permitting redacted output to be pasted into an external AI are different policy decisions at most organizations — clear both.

Project facts