MASKING · RBI-ALIGNED · v3.2

See only what
you strictly need
to see.

Redact Aadhaar numbers, PAN, phone numbers, and signatures — both on the document image and in the JSON response. Fully reversible with key-controlled unmasking and audit-logged access.

99.9%
PII detection rate
180ms
Avg masking time
12 types
Detected entities
VISUAL
API RESPONSE
BEFORE · RAW12 FIELDS
name:Priya Sharma
aadhaar:1234 5678 9012
pan:ABCDE1234F
mobile:+91 98765 43210
email:priya@fintech.in
dob:1992-03-14
address:42-B, Saket, Delhi
pincode:110017
AFTER · MASKED8 REDACTED
name:Priya Sharma
aadhaar:XXXX XXXX 9012
pan:ABXXX1234F
mobile:+91 98765 43210
email:p***ya@fintech.in
dob:1992-**-**
address:42-B, Saket, Delhi
pincode:1100**
Types of masking

Four masking modes.
Pick per endpoint.

Different systems have different needs. Your customer support team doesn't need the Aadhaar number; your auditor might. Our API respects that.

01 · VISUAL

Image-level redaction

Detects PII regions on scanned document images and blacks out the pixels. Returns a new image with bounding-box masks — safe to share downstream.

Government of India
Name: Priya Sharma
DOB: 14/03/1992
1234 5678 9012
02 · FIELD-LEVEL

Response masking

Mask specific JSON fields in API responses. Choose which fields to mask per role or per endpoint — pass a mask_fields array.

"aadhaar": "XXXX XXXX 9012",
"pan": "ABXXX1234F",
"mobile": "+91 98765 43210"
03 · IRREVERSIBLE

One-way masking

For data shared with untrusted systems or third-party analytics: mask PII irreversibly. The original values are never stored — your compliance obligation ends at the API call.

mode: "irreversible"
 keys destroyed
 no unmask possible
04 · REVERSIBLE

Vaulted masking

Masked values are encrypted in a per-customer vault with your KMS key. Authorized roles can unmask on demand — every access logged, every reason recorded.

mode: "reversible"
vault: "kms_8B3A2F"
unmask: role+reason
Entity types

Every PII entity that matters in India.

Trained specifically on Indian identifier formats. We don't just detect patterns — we understand context.

Aadhaar

XXXX XXXX 9012

PAN

ABXXX1234F

Mobile

+91 XXXXX 43210

Email

p***ya@X.in

Address

42-B, Saket, Delhi

Signature

bounding box · redacted

Photo

face region · blurred

Date of birth

1992-XX-XX
Regulatory posture

Built around
the rules you have to follow.

Data minimisation isn't optional anymore — regulators have moved from "best practice" to "findable in audit observations". Recspace masking was designed to the letter of the obligation.

RBI Masked Aadhaar

Aadhaar numbers in displays and downstream systems are masked to the last 4 digits by default — aligned with UIDAI guidance and RBI circulars.

DPDP Act 2023 ready

Data minimisation, purpose limitation, and consent tracking built in. Every PII access is logged against a stated purpose and retention window.

Encrypted key vaults

Reversible masking uses per-customer AWS KMS keys. You control rotation, you control access — we never see the plaintext after masking.

Integration

One call. Configured exactly how you need.

POST /v1/masking/apply
# Mask specific fields in a KYC response
curl -X POST https://api.recspace.in/v1/masking/apply \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "payload": { ... KYC output ... },
    "mask_fields": ["aadhaar", "mobile", "address"],
    "mask_mode": "reversible",
    "purpose": "customer_support_view",
    "retention_days": 90
  }'

# → 200 OK · 180ms
{
  "mask_id": "mask_8B3A2F",
  "masked_payload": {
    "name": "Priya Sharma",
    "aadhaar": "XXXX XXXX 9012",
    "mobile": "+91 XXXXX 43210",
    "address": "XXX, XXX, Delhi"
  },
  "vault": {
    "kms_key": "arn:aws:kms:ap-south-1:...",
    "expires_at": "2026-07-19T00:00:00Z"
  },
  "reversible": true
}
Audit & observability

Every unmask
leaves a trace.

Regulators don't just want to know the data is masked. They want to know who has seen the raw value, when, and why. That ledger is built in.

What we log

Immutable, signed, exportable.

Every unmask API call is written to a tamper-evident append-only log, with the operator's identity (from your SSO), timestamp, access purpose, and the specific field accessed.

Ship it to your SIEM via webhook, pull it into your audit platform via REST, or download the full session trace for a regulator visit.

View audit log format →

Audit log · last hour

14 ACCESSES
14:32:18
Rahul M.ops · fraud review
UNMASK
14:29:04
Priya S.risk · audit ticket #8412
UNMASK
14:28:11
svc_complianceservice · daily export
BULK
14:22:56
Arjun K.support · ticket #20814
UNMASK
14:18:39
svc_siemservice · log sync
METADATA

Want to keep less?

We'll help you map which fields to mask, where, and for whom — aligned with your specific compliance posture.