For banks

Customer document redaction for banks

Branch scanning, account opening packets, trade finance files and decades of archived customer records — all of it full of identifiers that were collected before anyone asked whether they should be stored in the clear.

Talk to our technical team → — for integration questions, a security review or a volume estimate.

Two problems, different shapes

The flow
Documents arriving today, from branches, the app and partners. One call at ingestion solves this permanently and the volume is predictable.
The archive
Years of scanned records already stored unmasked. This is a batch problem with a defined end, and it is usually the one that raises the audit finding.

They need different sizing. A flow integration is provisioned to your steady-state peak; a backlog run is provisioned for a fixed window and then stepped down. Both use the same key and the same endpoints.

Where a smaller institution has the advantage

Large banks have document management platforms with their own roadmaps, and inserting anything into them takes quarters. Cooperative banks, regional banks, small finance banks and the vendors who build for them can put a single REST call into their pipeline this month.

If you are a vendor building for banks, the same applies: your customers will ask where documents are processed and what you retain. "In Mumbai, and nothing" is a short answer to give them.

Remediating an archive

The flow integration is the easy half. The archive is where the audit finding comes from, and it is a project rather than a change.

1. Scope it
Count the documents and classify by type. A run you cannot size is a run you cannot schedule, and the estimate is usually wrong by an order of magnitude in the optimistic direction.
2. Sample first
Run a few hundred representative documents and read the manifest. The proportion coming back with nothing found is the number that determines how much human effort the project needs.
3. Size the window
Tell us the volume and the deadline. Throughput is provisioned for the run and stepped back down afterwards rather than being carried all year.
4. Make it resumable
Track per-document state in your own store against a stable id. A long run will be interrupted at least once, and one that restarts from the beginning will not finish.
5. Reconcile
The documents that found nothing are the ones the project did not fix. They need a decision — re-scan, manual redaction, or accept and record why.

If you are a vendor selling into banks

Document management platforms, loan origination systems, core banking integrators and BPOs all end up holding customer identity documents on behalf of a bank, and all get asked the same three questions in procurement.

Being able to answer a sub-processor question with a link rather than a meeting is worth more in a procurement cycle than most features.

Questions we get asked

Can this run on our own infrastructure?

The hosted API runs in ap-south-1 with no document retention, which answers most of what an on-premise requirement is usually trying to achieve. If your policy requires in-perimeter processing regardless, tell us and we will have that conversation directly rather than pretending the hosted service is something it is not.

Do you support masking archived documents in bulk?

Yes. The batch endpoints take many documents per call and return a ZIP with a manifest giving per-document status. Documents where no number was found come back unchanged and are listed as such — those are the ones still needing attention.

Are you SOC 2 or ISO 27001 certified?

Not today, and we will not imply otherwise on a page your auditor is reading. If a certification is a hard procurement gate, tell us before you spend time evaluating.

How do we scope an archive remediation?

Sample a few hundred representative documents first and read the manifest. The share coming back with nothing found tells you how much human effort the project actually needs, which is the number that makes or breaks the plan.

Can our integration be prevented from calling extraction endpoints?

Yes. Keys are scoped per endpoint and the API refuses anything outside the plan with a 403. It is enforced server-side, so it holds even if the integration's code tries.

Related

Talk to us about your document volume

Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.