Doc Sanitizer

Why this exists

In 2003, Tony Blair’s government published a Word document making the case for the Iraq War — the “Dodgy Dossier.” A researcher in Cambridge opened the file and noticed the change history embedded inside it. Within hours, the document had been picked apart in public: the names of the political staff who had edited it, the order in which they had worked on it, the source paragraphs that had been lifted (uncited) from a postgraduate student’s thesis. None of that was visible in the printed document. All of it travelled with the file.

Two decades on, the hidden data is still there, in every Word, Excel and PowerPoint file, by default. Microsoft’s own “Inspect Document” tool catches some of it; it misses categories like pivot table source caches, the contents of speaker notes, the SharePoint compliance tags that travel inside a corporate-exported file. A surprising amount of what you send is what you didn’t mean to send.

Doc Sanitizer surfaces every category in the document you opened, lets you strip it with one click, and verifies the result before reporting success.

How it works

• Inspect first — with decoded values

  Pick a document and Doc Sanitizer walks every part inside the file’s zip container and decodes what’s actually there. Not just “Document properties: 814 B” but “Author: Chris Burgess”, “Last modified by: Nick White”, “Company: SecretCorp Plc”. For Word: every tracked insertion and deletion with the author and date, every comment body in full, every embedded file. For Excel: hidden sheet names, the column names and source-range cached inside each pivot table, email-shaped author IDs from threaded comments, external workbook paths, connection strings. For PowerPoint: the full text of every speaker note, the titles of hidden slides. Fields that reveal identity are flagged.

• One-click sanitise

  Click Sanitise and the OOXML-aware writer drops the metadata-bearing parts wholesale, rewrites the [Content_Types].xml manifest and every .rels file to remove dangling references, and replaces docProps/core.xml and docProps/app.xml with empty shells. The visible content of the document — text, tables, slides, charts, formatting — passes through byte-for-byte. Hidden slides and hidden sheets are surfaced for your attention but preserved by default; deleting visible-but-unseen content is your call, not ours.

• Verification on every save

  After every sanitisation, Doc Sanitizer re-inspects the output zip and confirms zero metadata categories remain in the parts that should have been cleaned. If anything leaked through, the tainted file is deleted and you see a clear failure — you don’t accidentally ship a file you think is clean.

• Right-click integration

  Optionally install a Finder Quick Action so you can right-click any Word, Excel or PowerPoint document and pick Sanitize with Doc Sanitizer. Toggle it on or off from Settings → Finder integration; nothing is installed system-wide without your consent.

• The original is never touched

  The output is always written to a new path of your choosing (suggested name: <original>-sanitized.<ext>). The input document remains exactly as you opened it.

Supported formats

Doc Sanitizer handles the three OOXML formats Office produces:

• Word (.docx)

  Walks word/document.xml for tracked changes (w:ins, w:del, w:moveFrom, w:moveTo) and comment anchors; strips them while keeping accepted insertions and discarding accepted deletions. Removes word/comments.xml and the modern threaded-comment companions wholesale. Strips revision-save IDs (w:rsids) from word/settings.xml. Drops word/embeddings/, word/vbaProject.bin, customXml/. Empties the docProps trio.

• Excel (.xlsx)

  The widest hidden-data surface of the three. Drops xl/comments*.xml, the threaded-comment and persons registry, pivot caches (the original unfiltered rows behind every pivot table), external workbook references, connection strings, query tables, embeddings, VBA. Hidden sheets are surfaced in the inspection panel but preserved — that’s visible content, your call to remove.

• PowerPoint (.pptx)

  Strips ppt/notesSlides/ wholesale — the speaker-notes pane is the headline pptx leak. Removes ppt/comments/, the comment-author registry (which routinely leaks email-shaped userIds), embeddings, ink annotations, application tags, VBA. Hidden slides are surfaced with title sniffed and preserved.

What Doc Sanitizer does not do

Doc Sanitizer does not redact or modify the visible body of the document. To remove a sentence from a paragraph, a row from a table, or a slide from a deck, you’ll want Word, Excel or PowerPoint itself.

Doc Sanitizer does not handle the older binary Office formats (.doc, .xls, .ppt) or non-Office productivity formats (.odt, .ods, .odp) yet. OOXML (.docx / .xlsx / .pptx) is the dominant format the world actually shares; the legacy formats are a different surface.

Doc Sanitizer does not certify legal or regulatory compliance. It helps remove common categories of hidden data; it doesn’t certify your workflow against any specific standard.

Privacy

Doc Sanitizer makes one network connection on first launch to activate your licence key. After that, it makes no further network connections. Documents are processed entirely on your device — nothing about the file, its authors, its comment text, or its existence is sent anywhere. There are no analytics, no telemetry, no servers. See the privacy policy for full details.

Requirements

macOS 11 (Big Sur) or later. Apple Silicon (M-series) Macs. Distributed as a Developer ID signed and Apple-notarized disk image — not via the Mac App Store.

Support

For bug reports and feature requests, see the support page. For anything else, email support@whiteforgetech.co.uk.