The six leak vectors

Sending a workbook can expose more than the numbers you meant to share. This check looks at all six at once: personal data (emails, phone numbers, IDs, card and bank numbers), the file’s own document properties (author, company, revision history), internal notes left in cell comments, hidden sheets a recipient can simply unhide, external links and file paths that point at your network shares or local drives, and macros that a recipient’s security may flag.

What we clean, and what’s your call

Four of the six are safe to clean automatically, so we do — in a fresh copy: personal data is masked, identifying document properties are cleared, internal cell comments are removed, and any VBA macros are stripped. Macros get removed because a macro-enabled file is routinely blocked by the recipient’s security — and we tell you plainly that we did it: your original still has them, so if the recipient genuinely needs the macros, send them the original instead. The other two are yours to decide: hidden sheets and external links can be legitimate, so we never delete them silently. We report exactly what’s there, in plain language, and you choose whether to remove them in Excel before sending.

The before→after ledger is the point

Nothing happens quietly. You get a category-by-category breakdown — what was found, how much of it, and where — split into “we handled this for you” and “you should look at this.” The masked personal values are never echoed back to the page, so nothing can re-leak through this tool.

Know its limits

Personal-data detection is pattern-based: it reliably catches things with a recognizable shape, but not names or free-text personal details written in prose. Hidden rows and columns inside a sheet aren’t auto-flagged either. The ledger says so plainly — open the safe copy and scan it yourself before you share it.

Your original file is safe

The page reads your file in memory, cleans a copy, and hands that copy back. Your uploaded .xlsx is never changed and never stored — nothing is ever lost.

Enforce this on every file, automatically

You just safety-checked one file by hand. If files leave your store, pipeline, or team on a regular basis, your AI agent can run this exact same pre-send check on every one of them before it goes out — no upload, no browser, right where the file is generated. Install xlsx-for-ai and connect it over MCP, then ask Claude or Cursor to “make this workbook safe to send.” The agent calls the same xlsx_redact that powers this page and gets the full JSON manifest back, so a pre-send safety gate becomes one step in your own workflow instead of a thing someone has to remember to do.

npm install -g xlsx-for-ai

Get this ready to send safely — free.