Use case

Aadhaar and PAN masking for loan documents

The unmasked original is the liability. Mask between upload and storage and it never becomes a stored object — which is a far easier control to evidence than a deletion job you have to prove ran.

Talk to us about your document volume Read the docs

Talk to our technical team → — for integration questions, a security review or a volume estimate.

Mumbaiap-south-1, data stays in India
In memory onlynever written to disk
PDF, JPG, PNGup to 50 MB per document
Batchone call, many documents
Countedevery call reports what it did

The five-line change

Today

upload → store → process. The unmasked file is in object storage from the first second, and therefore in every backup and replica from then on.

Instead

upload → mask → store. Storage only ever sees the masked version. The original is discarded, not archived.

That is the entire architectural change. Everything downstream — your LMS, co-lending exports, audit samples, collections hand-offs — inherits the fix without being touched, because there is no longer a sensitive version to inherit.

Four ways this goes wrong

Branching only on HTTP 200. If no number could be read, the original comes back unchanged with a count of zero. That is a success status on an unmasked document. Check the count.
Masking after storage. "Store now, mask in the nightly job" means the unmasked file exists in a bucket, in its versioning history and in a backup. Masking later does not unmake those.
Drawing a rectangle on the PDF. The text layer survives underneath and comes back with copy-paste or pdftotext. Pages must be rasterised. Most in-house implementations get this wrong.
Masking Aadhaar and stopping. The same loan file holds a PAN, a cheque with an IFSC, and a payslip. /redact-pii is for the rest.

Handling the zero case

A document where no number was found is not an error and not a success. It is a finding, and it is the single most important thing to route correctly.

Count > 0

Masked. Store it and move on.

Count = 0

Nothing was found. The original is returned unchanged and is still fully readable. Route to human review — it is a bad scan, a cropped photo, or not the document type you expected.

Billing

A call that produced nothing is not charged. Convenient, but it also means your invoice will never flag the problem for you.

What "we mask documents" usually means in practice

Four implementations we see repeatedly. Three of them do not do what the team believes they do.

A rectangle on the PDF

An annotation drawn over a live text layer. Copy-paste returns the number; so does pdftotext. The document looks masked in every viewer, which is why this survives review.

CSS or a UI overlay

The number is covered in the viewer and present in the file. Anyone who downloads the original gets everything.

Masking the extracted field

The database stores XXXXXXXX1234 while the uploaded image sits in object storage, fully readable. The data is masked; the document is not.

Rasterise and paint

The only one that actually removes the number. The page becomes pixels, the redaction is drawn onto them, and there is nothing underneath.

Test yours in thirty seconds. Take a masked PDF, run pdftotext over it, and search the output for the digits. If they appear, your redaction is decorative.

Retrofitting a pipeline that already stores originals

Change the write path first. Stop creating new unmasked objects before you worry about the old ones. Every day you delay adds to the backlog you will have to remediate.
Then remediate backwards, newest first. Recent files are the ones most likely to be accessed, shared and exported.
Do not forget versioning. Object stores with versioning enabled keep the unmasked original as a prior version when you overwrite it. Masking in place without purging versions achieves nothing.
Check your backups. A masked object today does not unmake last month's snapshot. Know your backup retention, and be honest in the audit about the window.
Log the counts, keep the evidence. A per-document record of what was redacted and when is what turns "we mask documents" into something you can demonstrate.

Questions we get asked

Where exactly should the call go?

Between receiving the upload and writing it to storage. Anywhere later and the unmasked file has already been persisted, which is the thing you are trying to avoid.

What if the document has both an Aadhaar and a PAN?

Use /redact-pii, which covers both plus passport, voter EPIC, driving licence, GSTIN, IFSC, phone and email in one call. Use the specific endpoints when you also want the fields extracted.

Can we process a whole loan packet in one request?

Yes. The batch endpoints accept many documents and return a ZIP with a manifest giving per-document status, including which ones found nothing.

How do we test whether our current masking is real?

Run pdftotext over a masked PDF and search the output for the digits. If they come back, the redaction is an annotation over a live text layer and the number is still in the file. It takes thirty seconds and it is the check most teams have never run.

We already have years of unmasked files. Where do we start?

Change the write path first, so you stop adding to the problem, then remediate backwards from newest. And check whether your object store keeps prior versions — masking in place with versioning on leaves the original sitting there as a previous version.

Talk to us about your document volume

Tell us how many documents a month you process and what your peak looks like. We will size a plan, provision a key with a test quota, and answer a security questionnaire if you need one.

Contact sales Enterprise overview