PII Redaction API

Redact every identifier, on any document

One endpoint that does not need to know what the document is. Send a PDF or an image; get it back with every recognised identifier covered and a count by type telling you what was found.

Talk to us about your document volume Read the docs

Talk to our technical team → — for integration questions, a security review or a volume estimate.

11 types10 on by default
Any documentno parser required
Rasterisedno recoverable text layer
Batch/bulk/anonymise
Counted by typenever by value

The endpoints

POST /api/v1/redact-pii

One document. Optional types parameter to narrow or widen the set. Returns the redacted document with X-Redacted-Count and X-Redacted-Types.

POST /api/v1/bulk/anonymise

A batch. Returns a ZIP with the documents and a manifest giving per-document status.

GET /api/v1/pii-types

The type list with descriptions and defaults. Unauthenticated, so you can read it before a key is issued.

X-Redacted-Types reports counts by type and never the values found. A header carrying the identifier it just redacted would put that identifier into every access log and proxy between us and you, which would rather defeat the purpose.

Redaction, not masking

Masking

Covers the first eight digits of an Aadhaar number and leaves the last four readable — the UIDAI-recognised form. The document remains usable as a KYC record.

Redaction

Covers the identifier entirely. Use it when the document needs to be shareable rather than usable as identity evidence.

They are different products for different moments. Mask what you keep as a KYC record; redact what you send to a third party.

Choosing which types to enable

The defaults are chosen for a document you know nothing about. If you do know something about it, narrow or widen accordingly.

Unknown documents

Use the defaults. Every type on by default is checksum-validated or structurally distinctive enough to be safe on a document nobody has classified.

Bank statements

Add bank_account. You know the nine-to-eighteen-digit run is an account number here, which is exactly the knowledge the default cannot assume.

Legal and property documents

Consider narrowing. A sale deed carries survey numbers and registration numbers that no identifier type should be matching, and a false positive on a legal document is unrecoverable.

Contact-only redaction

Pass just phone_in,email when the goal is to stop a document being used to contact someone, rather than to identify them.

Reading the response

X-Redacted-Count is the number of regions covered after overlapping detections are merged — the figure to trust as "how much was redacted".
X-Redacted-Types is a JSON object of counts per type. Detections are counted per pass, so the same number found in two orientations counts twice; use it to see what kind of identifier was present, not as a precise tally.
A count of zero means nothing was found and the document is returned unchanged and fully readable. On this endpoint that is common and often correct — plenty of documents genuinely carry no identifier — but it still needs to be a branch in your code rather than an assumption.
Nothing is charged for a call that produced no redaction.
No values are ever returned. Counts by type only, so an identifier cannot end up in a log between us and you.

Questions we get asked

Which identifiers does it detect?

Aadhaar (checksum validated), VID, PAN, passport, voter EPIC, driving licence, GSTIN, IFSC, Indian mobile numbers and email addresses are on by default. Bank account numbers are available but off by default, because 9 to 18 digits with no checksum is indistinguishable from an invoice or policy number.

Does it work on documents you have never seen?

That is the design. It matches identifiers rather than recognising document layouts, so a utility bill, a rent agreement or a hospital discharge summary is handled without any per-document work.

What does it cost per document?

The same as any other document on your plan. A call that finds nothing is not charged.

Should we enable bank_account?

Only where you know the document. On a bank statement, yes. On an unclassified document it will match invoice numbers, policy numbers and customer IDs, and a false positive destroys the document you were trying to make shareable.

Why does X-Redacted-Types sometimes count more than there are numbers?

Detection runs several orientations and passes, and the type counts are per detection. The merged region count in X-Redacted-Count is the figure to treat as authoritative.

Talk to us about your document volume

Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.

Contact sales Enterprise overview