Removing personal data from Revit models and worksharing logs

Where does personal data hide in a Revit model?#

Personal data in a Revit model hides mostly in metadata that day-to-day users never open, not in the title block alone. Project Information carries client and owner details, workshared models record which user created or last changed elements, and linked file paths often include a person's Windows profile name.

Model content adds more. Interior fit-out models may tag workstations or rooms with staff names, room schedules may list occupants, and text notes or comments can hold phone numbers and emails from site meetings. Sheets carry Drawn By, Checked By and Approved By values, and title block families sometimes embed scanned signatures or professional seals.

Client identity is a related problem. Even with no individual named, a project address, building name or distinctive site layout can identify the client, which matters when a confidentiality clause or the license scope calls for de-identification.

Metadata checklist, field by field#

The metadata checklist below covers the places that most often carry names, contact details and client identifiers. Work through it per model and record each action in a preparation log.

What worksharing history and logs record#

Worksharing data is where Revit user names concentrate. In a workshared model, each synchronize with central is tied to the user name set in Revit's options, and the Show History command on the Collaborate tab lists those saves with dates, users and comments.

Outside the model file, the central model's backup folder holds a session log (.slog) recording which users opened and synchronized the model, and each workstation keeps journal files with user names and local paths. These help the firm diagnose problems and rarely belong in a licensed package.

If the approved scope does include collaboration history, because the value lies in how a team coordinated a model, replace each user name with a consistent pseudonym and role, such as Architect 3 or MEP coordinator 1, and keep the mapping table inside the firm. Pseudonymized records can still relate to identifiable people, so the privacy record should say who holds the key.

A safe order of operations for cleaning a model#

Cleaning a model safely follows a fixed order, because some steps erase the evidence needed to check earlier ones. Capture the before state first, change fields second and compare at the end.

Exports need the same scrutiny. IFC and DWG files exported from a cleaned model can still carry author and organization fields in their headers, layer names with initials and xref paths, so inspect exported files separately before they join the package.

• 1Copy the approved models to an isolated preparation folder; never edit the central model or the live project folder.
• 2Open each copy with Detach from Central and decide whether to preserve or discard worksets, based on the approved scope.
• 3Export Project Information, sheet lists and room schedules to spreadsheets to see every populated field before changing anything.
• 4Clear or replace personal and client fields, using a Dynamo script where the same parameters repeat across many models.
• 5Repath links and rename views, sheets and worksets to neutral, role-based names.
• 6Purge unused families and views, then search text notes, comments and keynotes for names, numbers and emails.
• 7Re-export the schedules, compare them with the first export and record every change in the preparation log.

Automated scanning helps, but review still matters#

Automated scanning finds patterns in exported text, but it does not understand a Revit model. Tools that detect names, emails and phone numbers are useful on exported schedules and notes, yet Presidio's own documentation warns that, because it relies on automated detection, there is no guarantee it will find all sensitive information.

Pair every scan with a manual pass by someone who knows the project. That reviewer will notice a room named after a donor, a view titled with a facilities manager's name, or a seating plan that identifies a tenant's staff. Record who reviewed each model and what they checked.

Check the Autodesk terms before any outside use#

Autodesk's terms shape what may be done with model content once it leaves the firm. Autodesk's General Terms include a section titled You Own Your Work, saying the customer keeps ownership of files, designs, models and data sets that it or its users create and upload.

AEC Magazine has also reported that a broad clause in Autodesk's terms and Acceptable Use Policy, read literally, would stop users from training their own AI models on output from an Autodesk application, and that the language had been in Autodesk contracts since May 2018. Read the current terms with counsel and record the conclusion in the rights review, next to the client agreements for each project.

Illustrative: an interiors practice prepares fit-out models#

Illustrative: a fictional architecture practice that specializes in corporate interiors reviews a set of tenant fit-out models for a possible license focused on space planning decisions. The digital practice leader expects title blocks to be the main issue.

The schedule exports show otherwise. Workstation tags carry tenant employees' names, room occupant fields list department heads, and several working views are named after the client's real estate manager. Worksharing history ties edits to individual staff user names.

The practice clears occupant and tag fields, detaches with worksets discarded, renames views and replaces sheet initials with role codes. Two models are dropped from scope because their floor plates identify a single well-known tenant even after cleaning, and the preparation log becomes part of the privacy record.

How SourceX approaches model preparation#

SourceX treats model cleanup as the Preparation step of the SourceX five-step transaction, after Rights has confirmed what the firm may license. The firm's own team works on copies held in firm-controlled storage, and the firm approves the result before anything moves to Delivery.

The preparation log, the list of excluded models and the reviewer sign-off form the privacy record in the SourceX Evidence Packet, alongside provenance, licensing rights, permitted use and release authorization.