A home loan file runs to tens of pages: the application, the KYC set, the sanction letter, the sale deed, bank statements. The Aadhaar number sits on the card and again in the deed's text, in Hindi as often as English. RBI's KYC Directions put the duty to redact on the lender, and the archive is where the risk lives.
Your AWS account
Documents stay in your account; masking runs next to your DMS and LOS.
SaaS API
Fastest to integrate for a new onboarding flow.
RBI, SEBI and IRDAI each put the duty on the regulated entity: it "shall ensure" the Aadhaar number is redacted. In practice customers hand over full copies, field staff photograph full cards, and the duty lands on whoever stores the file.
What Aadhaar Masking does: Masking happens at the point of capture or ingestion, by the API or inside your DMS, so the stored copy is the redacted one.
The large Indian KYC exposures of 2024–25 were not live systems: they were archives. 36 million KYC files of an RBI-registered NBFC in an open storage bucket; 27 million files of a micro-lender; 4 million KYC forms of an ISP, Aadhaar copies among them.
What Aadhaar Masking does: Point the batch mode at the archive: ZIPs of up to 500 MB through the API, or a folder-in, folder-out run on your own servers, at about 500 pages a minute.
Applicants write the number into forms. Sale deeds and gift deeds print both parties' numbers in running Hindi text. Maharashtra had to hide Aadhaar numbers in registered-document copies in 2024. And the QR code on older Aadhaar letters is plain XML that carries the full number.
What Aadhaar Masking does: Numbers in running text in English and Hindi, numbers split across lines, and every Aadhaar QR code, wherever it is on the page.
RBI's Directions require exception records "available for supervisory review", and RBI fined a public-sector bank ₹1.32 crore in 2024 for failing to preserve customer-identification records. An auditor wants to know which files were masked, when, and what was found.
What Aadhaar Masking does: Every answer carries a per-page record: Aadhaar found, number masked, QR covered; the on-premises edition writes a spreadsheet for the whole run.
“The bank shall, where its customer submits a proof of possession of Aadhaar Number containing Aadhaar Number, ensure that such customer redacts or blacks out his Aadhaar number through appropriate means”
Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 · Paragraph 23, Explanation 1 (the same text stood in Section 16 of the KYC Master Direction, 2016)
The duty to ensure redaction sits with the regulated entity. It is not the customer's job.
“No entity … shall retain Aadhaar numbers or any document or database containing Aadhaar numbers for longer than is necessary for the purpose specified to the Aadhaar number holder at the time of obtaining consent.”
Aadhaar (Sharing of Information) Regulations, 2016 · Regulation 6(5)
A loan file that keeps the full number for years is a retention problem, not just a sharing one.
“all data is stored only in servers located within India”
Reserve Bank of India (Digital Lending) Directions, 2025 · Paragraph 13(iv); data processed outside India "shall be deleted from servers outside India and brought back to India within 24 hours of processing"
Where a masking service runs, and where it keeps your files, is part of the compliance question.
“May extend to two hundred and fifty crore rupees”
Digital Personal Data Protection Act, 2023 · The Schedule: breach of the duty to take reasonable security safeguards, section 8(5)
An archive of unmasked Aadhaar copies is personal data without reasonable safeguards. This is the ceiling.
Upload a card photo, a scan or a short PDF and the production engine masks it while you wait, with a per-page record of what was covered. Or book thirty minutes with a HabileLabs engineer to see it on your document types and plan a deployment in your AWS account.
Or email support@habilelabs.io · Monday to Friday, 10:00–19:00 IST (excluding public holidays)
