Federal civilian · Moraph software

FOIA "Backlog Buster" Redaction Engine

A faster first pass on FOIA records, with every redaction decided by a person

Overview

What you are buying

The FOIA Redaction Engine reviews responsive records before your analysts do: it removes duplicates, threads email and proposes redactions for personal information and controlled unclassified information, each with a suggested exemption and the reason it was flagged. Analysts accept, reject or change every proposal, so their time goes on judgment rather than on searching pages. Nothing is released until a person has decided every redaction and a second reviewer has checked the set.

The problem it solves

Most of the effort in a FOIA response goes into line-by-line review of records that are repetitive, long and full of personal details. Backlogs grow when the same email appears many times, when scans are hard to read, and when redactions on one copy of a record are not carried to the others.

  • Analysts spend much of their time finding names, numbers and contact details rather than making exemption decisions.
  • Duplicates and long email threads mean the same text is reviewed, and sometimes redacted differently, more than once.
  • Controlled unclassified information can be missed when markings are inconsistent or absent.
  • Exemption logs and release packages are assembled by hand at the end, when deadlines are closest.

Who uses it

  • FOIA officers and analysts who review and redact records
  • FOIA public liaisons and program managers who track backlogs
  • Agency counsel who advise on exemptions and defend responses in litigation
  • Records managers who supply collections and retention guidance
  • Privacy officers who oversee Privacy Act requests and disclosures

Requirements it supports

Freedom of Information Act (5 U.S.C. 552)Privacy Act of 1974 (5 U.S.C. 552a)Controlled Unclassified Information program (32 CFR Part 2002)Federal Records Act (44 U.S.C. Chapter 31)Department of Justice Office of Information Policy guidanceSection 508 of the Rehabilitation Act

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    The review set

    Records for a request after de-duplication, with the number of proposed redactions waiting for an analyst.

    RecordTypeDuplicatesProposed redactionsStatus
    Email thread: site visit planningEmail (7 messages)312In review
    Inspection reportPDF05Accepted
    Meeting notesScanned document18, low-quality scanNeeds closer review
    Contract summaryDocument22Not started
    Visitor logSpreadsheet021Not started
    Records for a request after de-duplication, with the number of proposed redactions waiting for an analyst.
  2. Step 2

    Grouping duplicates

    Near-duplicates are grouped and their differences shown, so one decision covers every copy.

    Inspection report · 3 versions

    Review copy
    Final version (PDF)
    Other copies
    2 drafts
    Differences
    Draft 1 adds a handwritten note
    Status
    Decisions apply to all copies

    Differences to review

    • Handwritten note on page 2 of draft 1
    • Different signature block in draft 2
    Near-duplicates are grouped and their differences shown, so one decision covers every copy.
  3. Step 3

    Deciding each redaction

    Each proposal shows what was found and why; the analyst accepts, rejects or changes it and chooses the exemption.

    Email: site visit planning

    Proposed
    Personal mobile number
    Reason
    Personal contact information
    Suggested exemption
    (b)(6)
    Same text in
    3 duplicate records

    Other proposals in this record

    • Private individual's name: (b)(6) suggested
    • Document marked CUI: review required
    • Staff work email: no redaction suggested
    Each proposal shows what was found and why; the analyst accepts, rejects or changes it and chooses the exemption.
  4. Step 4

    Flagged controlled information

    CUI markings and likely controlled content are flagged for a person to decide, never redacted automatically.

    RecordPageFoundSuggested action
    Meeting notes1CUI banner markingReview with owner
    Contract summary3Portion marking (CUI)Review
    Email threadMessage 4Possible controlled content, unmarkedReview required
    CUI markings and likely controlled content are flagged for a person to decide, never redacted automatically.
  5. Step 5

    Second-level review

    A senior analyst checks the set and can return records with comments before release.

    RecordAnalyst decisionReviewerResult
    Email thread: site visit planning12 accepted, 1 addedSenior analystApproved
    Inspection report5 acceptedSenior analystApproved
    Meeting notes6 accepted, 2 rejectedSenior analystReturned: check page 2
    Contract summary2 acceptedSenior analystApproved
    A senior analyst checks the set and can return records with comments before release.
  6. Step 6

    Release

    Redactions are burned in, and the exemption log goes with the response.

    Release package

    1. All proposals decidedAnalyst
    2. Second-level review completeSenior analyst
    3. Redactions burned in, metadata removedEngine
    4. Exemption log exportedAnalyst
    5. Package sent to case managementEngine
    Redactions are burned in, and the exemption log goes with the response.

Workflows

The principal workflows

  1. Ingest

    Responsive records are loaded from collection and e-discovery exports: documents, PDFs, scans and email.

    • Load files, native documents, PDFs, scans and email exports are imported into a review set for the request.
    • Text is extracted, and scanned pages are read with optical character recognition so they can be searched and reviewed.
    • File metadata, custodians and dates are kept with each record.
    • Files that cannot be processed, such as damaged or password-protected files, are listed for an analyst to resolve.
  2. De-duplicate and thread

    Exact and near-duplicates are grouped and email is threaded, so each record is reviewed once and redacted consistently.

    • Exact duplicates are grouped, with one copy chosen for review.
    • Near-duplicates, such as drafts and copies with small differences, are grouped and their differences highlighted.
    • Email is threaded so a conversation can be reviewed from its most complete message.
    • Analysts can split a group if the engine has grouped records that should be reviewed separately.
  3. First pass

    The engine proposes redactions for personal information and marked or likely controlled unclassified information, with a suggested exemption and the reason for each.

    • Names, contact details, identification numbers and other personal information are found and highlighted.
    • CUI banner and portion markings are detected, and text that looks like controlled information is flagged for review.
    • Each proposal carries a suggested exemption and the reason it was flagged.
    • Records with low text quality, such as poor scans or handwriting, are flagged for closer human review.
  4. Review and release

    Analysts decide each proposal, a second reviewer checks the set, and the release package and exemption log are produced.

    • Analysts accept, reject or change each proposal, add their own redactions and apply the exemption.
    • A decision on one copy of a record is applied to its duplicates, with any differences flagged.
    • A second reviewer checks the set and can return records with comments.
    • Redactions are burned in and removed from file metadata, and the release package and exemption log are produced.
    • The package and its status are passed back to your FOIA case management.

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

FOIA analyst

FOIA specialist, government information specialist, paralegal

Does the line-by-line review of responsive records and decides each proposed redaction.

Sees

  • Requests and review sets assigned to them or their team
  • Records with proposed redactions, the reason for each and the suggested exemption
  • Duplicate groups and email threads for their records
  • Comments returned by the second-level reviewer

Does

  • Accepts, rejects or changes each proposed redaction and applies the exemption
  • Adds redactions the engine did not propose, with a justification
  • Searches the review set for a name, number or phrase and redacts every occurrence after checking them
  • Splits duplicate groups or threads that should be reviewed separately
  • Resolves files that could not be processed, or marks them for follow-up
  • Sends a completed set to second-level review

Cannot

  • Approve their own work for release
  • See requests that are not assigned to them or their team
  • Change exemption lists, custom terms or user roles
Approvals
Their decisions are checked by a senior analyst or reviewer before release.
Notified about
When a request is assigned to them, and when a reviewer returns records with comments.

Senior analyst or reviewer

Senior FOIA specialist, team lead, quality reviewer

Checks the analyst's work before release, so every set has a second pair of eyes.

Sees

  • Review sets sent to them for second-level review
  • Every redaction with its exemption, justification and who applied it
  • Differences between copies of duplicated records
  • The audit trail for the records under review

Does

  • Reviews the set and accepts it, or returns records to the analyst with comments
  • Changes a redaction or exemption where needed, with the change recorded
  • Escalates records to agency counsel for legal advice
  • Approves the reviewed set for release packaging

Cannot

  • Approve a set in which they made the redaction decisions themselves
  • Change user roles or system settings
Approvals
Their approval of the set is recorded; release packages go to the FOIA officer where your agency requires it.
Notified about
When a set is sent to them for review, and when counsel responds to an escalation.

FOIA officer or program manager

FOIA officer, FOIA program manager, FOIA public liaison

Runs the team's workload and signs off what the agency releases.

Sees

  • Every request and review set in their office or component
  • Workload and progress by analyst, request and stage
  • Release packages and exemption logs
  • Reports on proposals accepted, rejected and added

Does

  • Creates review sets and assigns them to analysts and reviewers
  • Reassigns work when priorities or staffing change
  • Approves release packages and sends them back to FOIA case management
  • Exports exemption logs for response letters and litigation
  • Runs team and program reports

Cannot

  • Change exemption lists, custom terms or integrations unless also given the administrator role
  • Approve a release package for records they reviewed themselves
Approvals
Final release approval, where your agency's process places it with the FOIA officer.
Notified about
When a set has passed second-level review and a release package is ready for approval.

Agency counsel

Agency attorney, Office of General Counsel staff

Gives legal advice on difficult records and exemption decisions.

Sees

  • Records and review sets escalated to them
  • Redactions, exemptions and justifications on those records
  • Comments from analysts and reviewers

Does

  • Comments on records and exemption decisions
  • Recommends changes to redactions or exemptions
  • Reviews exemption logs prepared for litigation

Cannot

  • Accept, reject or change redactions directly unless also given an analyst role
  • Approve release packages
  • See requests that have not been escalated to them
Approvals
None in the product; their advice is recorded in comments and acted on by the reviewer.
Notified about
When a record is escalated to them.

Administrator

FOIA systems administrator, IT application owner

Keeps the engine configured for the agency and controls who has access.

Sees

  • Users, roles and team assignments
  • Exemption lists, custom term lists and review workflow settings
  • Integration and import settings
  • The audit trail of configuration and permission changes

Does

  • Adds and removes users and assigns roles by office or component
  • Maintains the exemption list and agency-specific custom terms
  • Sets who can approve releases and whether second-level review is required
  • Manages integrations with collection tools and FOIA case management
  • Runs periodic access reviews

Cannot

  • Review records or apply redactions unless also given an analyst role
  • Edit or delete entries in the audit trail
Approvals
Changes to roles and settings are recorded in the audit trail; your agency can require a second administrator to confirm role changes.
Notified about
When an import or integration fails, and when a user requests access.

Auditor

Inspector General staff, internal control reviewer, records officer

Checks that the agency's FOIA review was done properly, without changing anything.

Sees

  • The audit trail for requests within the scope they are given
  • Exemption logs and release packages
  • Records of second-level review and approvals
  • Configuration and permission change history

Does

  • Searches and exports the audit trail
  • Reviews exemption logs and approvals
  • Exports evidence for an audit or inquiry

Cannot

  • Change any record, redaction, setting or user
  • See records outside the scope the administrator grants
Approvals
None.
Notified about
Not by default.

Consultation reviewer

Subject-matter reviewer in another office or component

Reviews specific records that touch another office's equities, when your agency handles that review inside the engine.

Sees

  • Only the records shared with them for consultation
  • Redactions and comments on those records

Does

  • Comments on whether records or passages should be withheld
  • Recommends redactions for the analyst to apply

Cannot

  • Apply or approve redactions
  • See any other part of the request
  • Keep access once the consultation is closed
Approvals
None; recommendations are applied by the analyst and checked in second-level review.
Notified about
When records are shared with them for consultation.

Permissions at a glance

ActionAnalystReviewerFOIA officerCounselAdminAuditorConsultation
Create review sets and assign workNo accessNo accessFullNo accessNo accessNo accessNo access
View records in a requestOwn work onlyOwn work onlyFullOwn work onlyNo accessView onlyOwn work only
Accept, reject or add redactionsOwn work onlyOwn work onlyNo accessNo accessNo accessNo accessNo access
Apply exemptions and justificationsOwn work onlyOwn work onlyNo accessNo accessNo accessNo accessNo access
Comment on recordsOwn work onlyOwn work onlyFullOwn work onlyNo accessNo accessOwn work only
Approve a set at second-level reviewNo accessApprovesNo accessNo accessNo accessNo accessNo access
Approve and send release packagesNo accessNo accessApprovesNo accessNo accessNo accessNo access
Export exemption logsOwn work onlyOwn work onlyFullView onlyNo accessView onlyNo access
Run team and program reportsNo accessView onlyFullNo accessNo accessView onlyNo access
Manage exemption lists and custom termsNo accessNo accessNo accessNo accessFullNo accessNo access
Manage users, roles and integrationsNo accessNo accessNo accessNo accessFullNo accessNo access
View the audit trailOwn work onlyOwn work onlyFullNo accessFullView onlyNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Releases always pass a second person: the reviewer who approves a set cannot be the analyst who made its redaction decisions, and a release package cannot be approved by someone who reviewed its records.
  • Roles are assigned by office or component, so analysts and reviewers see only the requests for their part of the agency unless your administrator grants wider access.
  • Every change to a user's role or access is recorded in the audit trail, and administrators can run periodic access reviews to confirm each person still needs the access they have.
  • Consultation reviewers and other temporary users see only the records shared with them, and their access ends when the consultation is closed or the administrator removes it.

Features

What it does

Proposed redactions

Names, contact details, identifiers and other personal information highlighted with the reason, for an analyst to accept or reject.

CUI detection

CUI markings and likely controlled information flagged for review, including when markings are inconsistent.

Suggested exemptions

Each proposal comes with a suggested exemption, such as (b)(6), that the analyst confirms or changes.

Consistent redaction

A decision on one copy of a record is applied to its duplicates, and differences between copies are flagged.

Email threading

Conversations reviewed from their most complete message, so earlier messages are not reviewed again.

Search across the set

Find every occurrence of a name, number or phrase across a request and redact it in one action, after review.

Custom terms

Agency-specific terms, such as internal system names or case identifiers, added to the list of things to flag.

Exemption log

Each redaction with its exemption and justification, exportable for the response letter and any litigation.

Second-level review

A quality check by a second reviewer before release, recorded in the audit trail.

Burned-in release

Redactions removed from the text and metadata of released files, not just covered.

Audit trail

Who proposed, accepted, rejected or changed each redaction, and when.

Accessible release files

Released PDFs keep searchable text for the unredacted content, to support Section 508 obligations for public posting.

Integrations

How it connects to your systems

Connects toHowWhat flows
Collection and e-discoveryLoad files, native documents, PDFs and email exports from the tools your agency uses to collect records.In: records, metadata and custodian information
Email archivesMailbox exports in standard formats, threaded on import.In: email messages and attachments
FOIA case managementRelease packages and status passed back to your request-tracking system through the Work API or export.Out: release package, exemption log, review status
Records managementReleased and withheld records filed to your records system with their disposition.Out: final records and metadata
Agency sign-inSingle sign-on through your agency identity provider, including PIV/CAC where your provider supports it.In: user identity and group membership (SAML or OpenID Connect)
Public reading roomReleased files exported in a form ready for posting to your agency's FOIA library.Out: redacted PDFs with searchable text
Work APIRequest, review and redaction data available to your reporting tools.Out: review progress and redaction counts by request

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Records kept in the United States

Records and review data are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Access by role

Analysts see only the requests assigned to them or their team; administrators set who can approve releases.

Encryption under controlled keys

Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view, proposal, decision and export recorded with the user and time.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

12 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Review operations

Open requests

For fOIA officer or program manager

Every open request with its review set, pages to review, proposals decided and proposals still outstanding.

Break down by
Request, Processing track (simple, complex, expedited), Component or office, Assigned analyst, Stage: first pass, analyst review, second review, ready for release
Delivered as
Live dashboard, with export to CSV or Excel
Used for
See where each request stands and which ones are stuck before they become overdue.

Analyst workload and progress

For fOIA officer or program manager, senior analysts

Records and pages assigned to each analyst, decided so far and still to do.

Break down by
Analyst, Request, Record type (email, document, scan), Week or month
Delivered as
Live dashboard, with export to CSV or Excel
Used for
Balance assignments across the team and plan staffing for large productions.

Review set composition

For fOIA analysts, FOIA officer

What was loaded for a request: records and pages ingested, duplicates and near-duplicates grouped, email threads, and files that could not be processed.

Break down by
Request, Source or custodian, File type, Processing outcome
Delivered as
Report per request, with export to CSV or PDF
Used for
Confirm the whole collection was loaded, and resolve damaged or password-protected files before review starts.

Backlog view

For fOIA officer or program manager, agency leadership

Requests in review by age and size, and the requests closed in a chosen period.

Break down by
Processing track, Component or office, Age band, set by your agency, Month or fiscal quarter
Delivered as
Dashboard and scheduled report by email
Used for
Track progress on backlog reduction and brief leadership with figures drawn from the review record.

Quality

Second-level review returns

For senior analysts, FOIA officer

Records returned at second review, with the reviewer's comments and the reason recorded for each return.

Break down by
Analyst, Reviewer, Return reason, Exemption involved
Delivered as
Live dashboard, with export to CSV or Excel
Used for
Spot recurring issues and target guidance or training where it is needed.

Proposal decisions

For fOIA officer, administrator

How analysts decided the engine's proposed redactions: accepted, changed or rejected, and redactions added by hand that the engine did not propose.

Break down by
Type of information (names, contact details, identifiers, CUI), Request, Analyst, Record type
Delivered as
Report, with export to CSV or Excel
Used for
See where the first pass helps and where it needs closer attention, and adjust term lists and settings with the evidence in hand.

Consistency across duplicates

For senior analysts

Groups of duplicate or near-duplicate records where redactions or exemptions differ between copies, and how each difference was resolved.

Break down by
Request, Duplicate group, Analyst, Resolution
Delivered as
Report per request, shown before release
Used for
Make sure the same text is treated the same way everywhere it appears in a release.

Exemptions and litigation

Exemption log

For fOIA analysts, agency counsel

Every redaction in a release with its page, exemption and justification.

Break down by
Request, Record, Exemption, Reviewer
Delivered as
Export to Excel, CSV or PDF
Used for
Write the response letter, answer an administrative appeal, or start a Vaughn index if the request is litigated.

Exemptions applied

For fOIA officer, agency counsel

Exemptions applied by request and across the program, including exemption 3 statutes where your agency records them.

Break down by
Exemption, Component or office, Processing track, Fiscal year
Delivered as
Dashboard, with export to CSV or Excel
Used for
Understand how exemptions are used across the program and check that use is consistent between offices.

Release package record

For fOIA officer, agency counsel, auditors

What was released for a request and when, who approved it at each level, and the files in the package.

Break down by
Request, Release or interim release, Approver, Date
Delivered as
Report per request, with export to PDF
Used for
Show exactly what was produced if a release is appealed, litigated or audited.

Annual FOIA report data

Annual report data extract

For fOIA officer or program manager, Chief FOIA Officer's staff

The review-side figures your agency needs for its annual FOIA report, such as releases in full and in part, exemptions applied and pages processed, for the fiscal year.

Break down by
Fiscal year, Component, Processing track, Exemption
Delivered as
Export to CSV or Excel, for combining with your request-tracking system's figures
Used for
Prepare annual report data from the review record instead of compiling it by hand. Request-level figures such as receipts and response times come from your FOIA case management.

Audit trail report

For auditors, administrators, agency counsel

Who viewed, changed, approved or exported each record, redaction and release, with dates and times.

Break down by
User, Request, Action, Date range
Delivered as
Search on screen, with export to CSV
Used for
Answer oversight, inspector general and litigation questions about how a release was handled.

Exports, access and evidence

  • Any report can be exported to CSV or Excel, and most to PDF; reports can also be scheduled to arrive by email for the people who need them.
  • Your administrators can save filtered views and build their own reports from the fields in the review record, without a request to Moraph.
  • Review, decision and release data is available through the Moraph Work API, so your agency can combine it with request-tracking data in its own business-intelligence tools.
  • Reports follow each person's role and office: an analyst sees their own work, a program manager sees their component, and redacted content appears only to people allowed to see the underlying records.
  • Reports can be run as of a past date and give the same result each time, and every report run and export is recorded in the audit trail.

Deployment

Where and how it runs

Moraph cloud, United States

Hosted in the United States region, with records kept in the US.

Dedicated environment

A single-tenant environment for agencies that require isolation, scoped in the proposal.

With a managed service

Optionally run alongside a Moraph managed service for administration, term-list maintenance and integration support.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery

We review your current FOIA process, collection tools, case management and release practice with your FOIA office.

Exemptions and terms

Your exemption list, standard justifications and agency-specific terms to flag are configured with your analysts and counsel.

Roles and approvals

Roles, teams and the second-review and release approvals are set to match your process.

Integrations

Imports from your collection tools and exports to case management and records systems are set up and tested.

Trial on closed requests

The engine is run on records from requests you have already answered, so your team can compare its proposals with their own decisions.

Training and handover

Analysts, reviewers and administrators are trained, and administrators receive runbooks for maintaining terms and settings.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • It proposes; it never releases. Every redaction is accepted by a person, and exemption decisions belong to your agency.
  • It can miss information, especially context-dependent material such as deliberative content under (b)(5). Analysts remain responsible for a complete review.
  • Handwriting, poor-quality scans and some file types reduce detection accuracy and need closer human review.
  • Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
  • It is not designed for classified information. Records containing classified material must be handled outside it under your agency's procedures.
  • Audio and video redaction is not included.
  • It is not a request-tracking system. It works alongside your FOIA case management.
  • Consultations and referrals to other agencies are managed in your existing process; the engine can export records for them.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. How do the engine's proposals compare with your analysts' decisions on a closed request?
  2. How does it handle your most common record types, including scans and long email threads?
  3. How are duplicates grouped, and how easily can an analyst split a group?
  4. How are CUI markings and unmarked controlled content flagged?
  5. What does the exemption log look like, and does it meet your counsel's needs?
  6. How would it connect to your collection tools and FOIA case management?

Questions

Frequently asked questions

Does the engine decide what to withhold?

No. It proposes redactions and suggests exemptions. A person accepts, rejects or changes every proposal, and the exemption applied is your agency's decision.

Can it handle scanned paper records?

Yes. Scanned pages are read with optical character recognition. Detection is less reliable on poor scans and handwriting, so those records are flagged for closer human review.

Can we add our own terms to look for?

Yes. Administrators can add agency-specific terms, such as internal system names or case identifiers, to the list of things the engine flags.

Is it FedRAMP authorized?

No. Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.

Can we use it for Privacy Act requests?

Yes, the same review and redaction workflow applies. How a request is processed under the Privacy Act and FOIA remains your agency's decision.

How do we try it before buying?

A demonstration uses sample records. For a deeper evaluation, a pilot can run on records from requests you have already answered, so your team can compare the engine's proposals with their own decisions.

Next steps

Evaluate FOIA "Backlog Buster" Redaction Engine

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: FOIA "Backlog Buster" Redaction Engine guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: FOIA "Backlog Buster" Redaction Engine support guide.