AWS Qualified Software · On AWS Marketplace · Measured on 10,001 real files
Aadhaar Masking finds every Aadhaar number and QR code in your KYC and loan files and covers it in UIDAI's masked form: 99.94% of numbers and 100% of QR codes in a measured test of 10,001 real loan files, with the method and the misses published. Run it as an API, inside your own AWS account, or on your own servers.
BeforeAfterMeasured on 10,001 real loan files, 15 October 2026; method on the Accuracy page. The misses are listed too: how it was measured.
Regulators put the duty to redact on the entity that holds the copy, the penalties now have a schedule, and the number is in more places than the card. Each point below links to the text it comes from.
RBI, SEBI and IRDAI each put the duty on the regulated entity: it "shall ensure" the Aadhaar number is redacted. In practice customers hand over full copies, field staff photograph full cards, and the duty lands on whoever stores the file.
What Aadhaar Masking does: Masking happens at the point of capture or ingestion, by the API or inside your DMS, so the stored copy is the redacted one.
The large Indian KYC exposures of 2024–25 were not live systems: they were archives. 36 million KYC files of an RBI-registered NBFC in an open storage bucket; 27 million files of a micro-lender; 4 million KYC forms of an ISP, Aadhaar copies among them.
What Aadhaar Masking does: Point the batch mode at the archive: ZIPs of up to 500 MB through the API, or a folder-in, folder-out run on your own servers, at about 500 pages a minute.
Applicants write the number into forms. Sale deeds and gift deeds print both parties' numbers in running Hindi text. Maharashtra had to hide Aadhaar numbers in registered-document copies in 2024. And the QR code on older Aadhaar letters is plain XML that carries the full number.
What Aadhaar Masking does: Numbers in running text in English and Hindi, numbers split across lines, and every Aadhaar QR code, wherever it is on the page.
UIDAI's Circular 14 limits where Aadhaar data may be hosted. RBI's Digital Lending Directions require that "all data is stored only in servers located within India" and that anything processed abroad is deleted and brought back within 24 hours. Most masking APIs want your documents on their servers.
What Aadhaar Masking does: Run it inside your own AWS account from AWS Marketplace, or on your own servers. Nothing leaves. Nothing to explain.
A card photo is the easy case. The engine was tuned on what lenders actually hold: deeds in Hindi, forms, statements, ZIP archives, and the photos field staff take.
Card fronts and backs, PVC cards and their small second copy, e-Aadhaar letters, UIDAI verification screenshots, photocopies of photocopies.
Written into application forms, printed in the running text of sale and gift deeds and loan agreements in English and Hindi, split across two lines, or in a table row labelled Aadhaar.
The secure QR on cards and the plain-text QR on older letters, covered whole, wherever they are on the page.
Twelve-digit Aadhaar numbers in cells are replaced with XXXXXXXXXXXX; other numbers in the sheet are left as they are.
ZIP files of up to 500 MB through the API, with the folder structure kept and a per-file report; or a folder run on your own servers.
Rotated, sideways, blurred, in a plastic sleeve, under glare, inside a collage: the page is looked at four ways round and read twice.
Detection finds candidates; reading and the Verhoeff checksum prove them; the page read catches what detection missed; the cover ends exactly after the eighth digit.
PDF pages are rendered at 200 dpi and every page is cleaned to even lighting, so a shaded phone photo and a flat scan look alike to the next steps.
A detector trained on Indian KYC documents boxes Aadhaar numbers and QR codes, looking at the page four ways round so a sideways or upside-down card is still found.
Every candidate box is read with OCR and the digits grouped the way a card prints them.
A number must prove itself: twelve digits, printed 4-4-4 or run together, never opening with 0 or 1, and a valid Verhoeff checksum; or printed as a card prints it on a page that says Aadhaar.
Every line of the page is read for numbers the detector missed: a number written into a form, a deed's "Aadhaar No." in running text, the small second copy under a card's photo, a number split across two lines.
Every QR code on the page is decoded. One that carries UIDAI's record is covered wherever it is, whether the detector boxed it or not; a payment code, an e-stamp or a link is left alone.
A card photographed front and back, or copied twice into one PDF, often reads cleanly on one page and a digit wrong on the other. A number confirmed on one page covers its misread copy on the others.
The first eight digits are painted over and the last four stay readable, UIDAI's own masked form. The cover ends in the gap after the eighth digit, not inside it. QR codes are covered whole.
The same engine in every edition. Choose by where your documents may go and who you want running the infrastructure.
Your AWS account
The same API and engine, deployed into your own AWS account with one CloudFormation stack in about eight minutes. Documents, storage and logs stay with you; AWS bills the software with your other AWS charges; the licence is checked through AWS License Manager.
SaaS API
One HTTPS endpoint, one API key. Send a file, get the masked copy back with a per-page record. Images and short PDFs return in the same call; long PDFs, ZIPs of up to 500 MB and Excel sheets run in the background with a task you can poll.
Your own servers
A Docker image that runs on an ordinary CPU server, a desktop or a laptop. Point it at a folder of images and PDFs; it writes the same folder back masked, with a spreadsheet saying what it did to every file. No network needed at run time.
AWS Marketplace
The only Aadhaar masking product listed on AWS Marketplace as of October 2026. Billed with your other AWS charges; INR private offers through AWS India. See the listing
Available in AWS Marketplace
By category, not by brand. The review behind each cell was done in October 2026; where a cell says a figure is published, the Accuracy page is where it is published.
| Compared on | Manual maskingStaff black out copies by hand or in an image editor | Generic OCR and redaction toolsText search and redact on scanned pages | Cloud KYC APIsVendor-hosted masking endpoints | On-premises redaction suitesInstalled document-processing software | Aadhaar Masking by HabileLabsHosted API, your AWS account, or on-premises |
|---|---|---|---|---|---|
| Accuracy measured and published, with the misses | Depends on the person and the day | Marketing figures without a method, where any | 99.94% of numbers, 100% of QR codes, on 10,001 real files | ||
| Aadhaar QR codes covered | If the person knows to | Text tools do not see codes | Some do, some do not | Whole, wherever they are on the page | |
| Numbers in running text, in Hindi as well as English | Slow; easy to miss the second party | English text only, if the scan is clean | Single card images in most cases | Deeds, agreements and forms; Devanagari labels read | |
| Multi-page loan files and archives | Does not scale | Often one page or one image per call | 500-page PDFs, 500 MB ZIPs, folders; about 500 pages a minute | ||
| Documents never leave your environment | Documents go to the vendor | Your AWS account or your servers; the hosted API if you prefer | |||
| Buy and run it from AWS Marketplace, on your AWS bill | The only Aadhaar masking product listed, October 2026 | ||||
| Public pricing | Staff time | Licence, not per document | Quote per call | Page packs in USD and INR on the pricing page | |
| A record per page of what was found and covered | In every API answer; a spreadsheet per run on-premises |
Lenders that run Aadhaar masking by HabileLabs
As published on habilelabs.io and finhub.habilelabs.io.
Not badges: the texts. Each quote is the regulator's own wording with a link to the instrument; the Security page has all of them.
“The bank shall, where its customer submits a proof of possession of Aadhaar Number containing Aadhaar Number, ensure that such customer redacts or blacks out his Aadhaar number through appropriate means”
Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 · Paragraph 23, Explanation 1 (the same text stood in Section 16 of the KYC Master Direction, 2016)
The duty to ensure redaction sits with the regulated entity. It is not the customer's job.
“No entity … shall retain Aadhaar numbers or any document or database containing Aadhaar numbers for longer than is necessary for the purpose specified to the Aadhaar number holder at the time of obtaining consent.”
Aadhaar (Sharing of Information) Regulations, 2016 · Regulation 6(5)
A loan file that keeps the full number for years is a retention problem, not just a sharing one.
“May extend to two hundred and fifty crore rupees”
Digital Personal Data Protection Act, 2023 · The Schedule: breach of the duty to take reasonable security safeguards, section 8(5)
An archive of unmasked Aadhaar copies is personal data without reasonable safeguards. This is the ceiling.
“It shall be ensured that full Aadhaar number is not stored and displayed anywhere in the system and wherever required only last 4 digits of Aadhaar number may be displayed.”
SEBI Master Circular on Know Your Client (KYC) norms · SEBI/HO/MIRSD/SECFATF/P/CIR/2023/169
For intermediaries the rule reaches the systems, not just the paperwork: nothing stored or shown beyond the last four digits.
More on the FAQ page.
Send a card photo, a scan or a short PDF and get it back masked by the production engine, with a per-page record of what was covered. Or book thirty minutes with a HabileLabs engineer to see it on your document types and plan a deployment in your AWS account.
Or email support@habilelabs.io · Monday to Friday, 10:00–19:00 IST (excluding public holidays)
