The Aadhaar and PAN endpoints know what they are looking at. This one does not, and that is the point — a KYC folder is full of passports, licences, voter cards, utility bills and bank statements that no document-specific tool will touch.
Talk to our technical team → — for integration questions, a security review or a volume estimate.
Every team that has tried this in-house has written the twelve-digit regex. Here is what it matches that it should not, and misses that it should.
Choosing wrongly is a quiet failure in both directions: redact what you needed to keep and the file no longer evidences anything; mask what you were sending outward and you have shared four digits and a name with someone who should have had neither.
That risk is the reason for the design. Every type on by default is checksum-validated or structurally distinctive, and the one genuinely ambiguous type — bank account numbers — is off unless you ask for it.
Yes. Pass the types you want and the rest are left alone. GET /api/v1/pii-types lists them all with a description and whether each is on by default, and it needs no API key so you can read it before one is issued.
No. Names are not pattern-detectable without a model that would remove the wrong ones as often as the right ones. This covers identifiers, not free text.
No. Images are painted over and PDFs are rasterised before the redaction is drawn, so there is no text layer left underneath.
Because twelve digits also describes a phone number with a country code, an invoice number and a policy number, and because Aadhaar is printed in groups of four so a token-level match finds nothing. The Verhoeff checksum removes almost all the false positives, and it is not something a regex can express.
Mask what stays inside your organisation, because the document still has to function as a KYC record. Redact what leaves, because the recipient does not need to identify the person from it.
Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.