One installer carries the whole program: the recognition model, the OCR models, the document runtimes and the browser engine it draws with. Nothing is fetched while it installs and nothing is fetched while it runs, so a machine that has never been online installs and works like any other. There is no account step, because there is no account.
Windows 10 and 11 today. macOS and Linux are coming soon — the cards below say what each one is waiting on.
NO ACCOUNT · NO TELEMETRY · NOTHING FETCHED DURING INSTALL · BUILT FROM COMMIT e94d976
Choose your platform
The same engine and the same rule pack run on all three — what differs is whether a build has been through release verification. Only one has, so only one is offered.
Carries the recognition model, the OCR models, the ONNX runtime, pdfium and a pinned WebView2 runtime. Nothing is fetched during installation.
The build leg needs Mac hardware, and a Developer ID signature is what keeps Gatekeeper from blocking it. Neither is in place yet, so there is nothing to download.
The Linux build runs on every commit and its packages pass the render probe, but they have not been through release verification, so they are not published here yet.
Three minutes, one dialog you should not be surprised by, and no network at any point.
Double-click the .exe. It writes the program, the models and a pinned browser runtime into Program Files and adds a Start-menu entry. Nothing is downloaded during the install, so it finishes at the same speed on an air-gapped machine.
The installer is signed with minisign, not with an Authenticode certificate, so SmartScreen shows “Windows protected your PC”. Choose More info → Run anyway. Before you do, check the SHA-256 below — that is the check the certificate would not have given you anyway.
The program opens on the file picker. Detection, review and the final re-scan all run on the machine in front of you; the update check is off until somebody turns it on, and it is the only thing in the program that can open a socket.
Verify what you downloaded
Every installer is signed with minisign and listed in a SHA256SUMS file that is signed too. The signature's own comment records the product, version, commit and build time, and is covered by the signature — so it says not just that the file is intact, but which build it is.
The public key belongs on a page like this one rather than only inside the download: a key that travels with the file it authenticates proves nothing. Compare the copy in the release folder against the one printed here.
A failed check means the file is not what Oulution built. Do not install it — tell us, and download again.
893e21fbdb4f06760e9a467503d6d6159af28e2665504ee9e777bc972a2f3b97
RWSXGhIyTnwDr7Uk5Cmvg9wmVu7ISYKiXWE4/JGsonqggev2EcX5EtmB
Get-FileHash ".\Ouli Redact_0.1.0_x64-setup.exe" -Algorithm SHA256minisign -Vm "Ouli Redact_0.1.0_x64-setup.exe" -p oulution-release.pubminisign -Vm SHA256SUMS -p oulution-release.pub
sha256sum -c SHA256SUMSThe .minisig,
SHA256SUMS and verification
notes sit next to the installer — the links are on the Windows card above.
What is in the 519 MB
A tool that fetches its model on first run is a tool that needs the network on first run. This one carries everything, which is why it is the size it is.
The on-device model that finds names, organisations and addresses, with the ONNX runtime it needs.
Three models for pages that arrive as scans with no text layer. Also on-device.
The PDF engine and the Office readers, so .docx, .xlsx, .pptx, .pdf and .eml are read from the inside.
A fixed WebView2 build, used instead of whatever Evergreen version the machine happens to have — the window looks and behaves the same on every install.
oulution-redact.exe, installed beside the window, for batch work and scripted pipelines.
The identifier rules the tool ships with, signed, and replaceable from a USB stick with a newer signed pack.
| Operating system | Windows 10 or Windows 11, 64-bit. |
|---|---|
| Processor | Any x86_64 CPU. No GPU is used or required. |
| Disk | About 1.2 GB once installed, plus room for the documents you work on. |
| Network | None, ever. Not for installing, not for licensing, not for running. |
| Privileges | Administrator for the install. The program itself runs as the signed-in user. |
Every one of these is something you would otherwise find out at an inconvenient moment.
Windows will call the publisher unknown, and it is right to: no certificate authority has vouched for this file. The minisign signature proves it is byte-for-byte what Oulution built, which is a different — and checkable — claim. An OS-trusted certificate is a purchase decision, not an oversight.
The engine builds and its tests pass on Linux on every commit, and the packages clear the render probe. That is not the same as a release, so nothing is offered here for either platform until it has been through release verification.
The update check is off by default and never installs anything on its own. When it is switched on it reads one manifest from one endpoint, and the program refuses any update whose signature does not match the release key printed above.
This page describes software. What must be redacted, and for whom, stays with the firm; the tool's job is to make sure nothing reaches that decision unseen.
The installer runs silently for deployment, the headless CLI comes with it, and a licence is a signed file rather than a call home. Tell us how many machines and which platforms you need.
SILENT INSTALL · HEADLESS CLI · SIGNED LICENCE FILE · AIR-GAPPED MACHINES ARE A NORMAL DEPLOYMENT