No badges that say "compliant". Below: exactly what each edition stores and for how long, what never appears in a log, and the regulators' own words with links to the instruments.
Last updated
| AWS Marketplace edition | Hosted API | On-premises edition | |
|---|---|---|---|
| Where documents are processed | Your AWS account, your region | HabileLabs' AWS account, Mumbai | Your server or data centre |
| What leaves your environment | A licence check; a daily page count unless switched off | The document, for the time it takes to mask | Nothing |
| Retention | Deleted within a day, in your bucket | Deleted within 24–48 hours | Your folders, your policy |
| Audit record | Per-page JSON in every answer, plus your own CloudWatch logs | Per-page JSON in every answer | Spreadsheet per run, row per file |
TLS 1.2 or better at the edge, with a web application firewall in front of the API; storage encrypted at rest with no public access; download links signed and short-lived.
Document content, Aadhaar numbers and API keys. Logs hold request ids, timings, page counts and the per-page record of what was found and covered.
Documents are not used to train or tune anything. The hosted service keeps no copy past the retention window; the other editions never see your documents at all.
Each quote is the regulator's own wording, with the instrument, the clause and a link. The line under each says what it means for a lender.
“Masked Aadhaar implies replacing of first 8 digits of Aadhaar number with 'xxxx-xxxx' while only last 4 digits of the Aadhaar Number are visible.”
UIDAI FAQ: what is masked Aadhaar · e-Aadhaar FAQ
This is the form the engine produces: the first eight digits covered, the last four left readable.
“no entity, including a requesting entity, which is in possession of the Aadhaar number of an Aadhaar number holder, shall make public any database or record containing the Aadhaar numbers of individuals, unless the Aadhaar numbers have been redacted or blacked out through appropriate means, both in print and electronic form.”
Aadhaar (Sharing of Information) Regulations, 2016 · Regulation 6(3)
Any copy that leaves your control, on paper or as a file, must already be masked.
“No entity … shall retain Aadhaar numbers or any document or database containing Aadhaar numbers for longer than is necessary for the purpose specified to the Aadhaar number holder at the time of obtaining consent.”
Aadhaar (Sharing of Information) Regulations, 2016 · Regulation 6(5)
A loan file that keeps the full number for years is a retention problem, not just a sharing one.
“Actual Aadhaar number should not be stored in any business databases other than ADV”
UIDAI Circular No. 14 of 2025 (Aadhaar Data Vault) · Directions to requesting entities
For requesting entities the full number belongs in the Aadhaar Data Vault alone; documents elsewhere should carry the masked form.
“The bank shall, where its customer submits a proof of possession of Aadhaar Number containing Aadhaar Number, ensure that such customer redacts or blacks out his Aadhaar number through appropriate means”
Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025 · Paragraph 23, Explanation 1 (the same text stood in Section 16 of the KYC Master Direction, 2016)
The duty to ensure redaction sits with the regulated entity. It is not the customer's job.
“RE shall ensure to redact or blackout the Aadhaar number in terms of Section 16.”
RBI amendment to the KYC Master Direction (Video-based Customer Identification Process) · RBI/2019-20/138, DOR.AML.BC.No.27
Video KYC captures are covered too: the Aadhaar shown on camera must end up redacted in the record.
“Every reporting entity shall, where its client submits his Aadhaar number, ensure such client to redact or blackout his Aadhaar number through appropriate means where the authentication of Aadhaar number is not required under sub-rule (15).”
Prevention of Money-laundering (Maintenance of Records) Amendment Rules, 2019 · Rule 9(16), G.S.R. 108(E)
The root rule behind RBI, SEBI and IRDAI's wording: every reporting entity, every Aadhaar copy taken without authentication.
“It shall be ensured that full Aadhaar number is not stored and displayed anywhere in the system and wherever required only last 4 digits of Aadhaar number may be displayed.”
SEBI Master Circular on Know Your Client (KYC) norms · SEBI/HO/MIRSD/SECFATF/P/CIR/2023/169
For intermediaries the rule reaches the systems, not just the paperwork: nothing stored or shown beyond the last four digits.
“At no point in time, more than last four digits of the Aadhaar number of any individual should be stored by the insurers in physical or digital form.”
IRDAI circular on Aadhaar as a KYC document · Circular of 29 January 2019, as reported
Insurers may keep the last four digits and nothing more, on paper or on disk.
“Insurers shall ensure to redact or blackout the Aadhaar number as per extant PML Rules”
IRDAI Master Guidelines on Anti-Money Laundering / Counter Financing of Terrorism, 2022 · IRDAI/IID/GDL/MISC/160/8/2022, effective 1 November 2022
The same "shall ensure" duty as banks and NBFCs, written into the insurance AML guidelines.
“May extend to two hundred and fifty crore rupees”
Digital Personal Data Protection Act, 2023 · The Schedule: breach of the duty to take reasonable security safeguards, section 8(5)
An archive of unmasked Aadhaar copies is personal data without reasonable safeguards. This is the ceiling.
“securing of personal data through encryption, obfuscation, masking or the use of virtual tokens mapped to that personal data”
Digital Personal Data Protection Rules, 2025 · Rule 6(1)(a), the minimum reasonable security safeguards
Masking is named in the Rules as a minimum safeguard.
“within seventy-two hours of becoming aware of the breach”
Digital Personal Data Protection Rules, 2025 · Rule 7(2)(b), notice of a personal data breach to the Board
Three days to tell the Board, and every affected person must be told without delay.
“Whoever, intentionally discloses, transmits, copies or otherwise disseminates any identity information collected in the course of enrolment or authentication to any person not authorised under this Act … shall be punishable with imprisonment for a term which may extend to three years”
Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 · Section 37
Disclosure of identity information is a criminal offence, not only a regulatory one.
“all data is stored only in servers located within India”
Reserve Bank of India (Digital Lending) Directions, 2025 · Paragraph 13(iv); data processed outside India "shall be deleted from servers outside India and brought back to India within 24 hours of processing"
Where a masking service runs, and where it keeps your files, is part of the compliance question.
RBI, SEBI and IRDAI each put the duty on the regulated entity: it "shall ensure" the Aadhaar number is redacted. In practice customers hand over full copies, field staff photograph full cards, and the duty lands on whoever stores the file.
What Aadhaar Masking does: Masking happens at the point of capture or ingestion, by the API or inside your DMS, so the stored copy is the redacted one.
The large Indian KYC exposures of 2024–25 were not live systems: they were archives. 36 million KYC files of an RBI-registered NBFC in an open storage bucket; 27 million files of a micro-lender; 4 million KYC forms of an ISP, Aadhaar copies among them.
What Aadhaar Masking does: Point the batch mode at the archive: ZIPs of up to 500 MB through the API, or a folder-in, folder-out run on your own servers, at about 500 pages a minute.
The Digital Personal Data Protection Act's schedule caps the penalty for failing reasonable security safeguards at two hundred and fifty crore rupees. The 2025 Rules name "encryption, obfuscation, masking" as the minimum safeguards and give you seventy-two hours to notify the Board of a breach. Full effect: 13 May 2027.
What Aadhaar Masking does: A masked archive is a safeguarded archive; the masked copy is what a breach would expose.
UIDAI's Sharing of Information Regulations forbid keeping Aadhaar numbers "for longer than is necessary", and Circular 14 of 2025 tells requesting entities the actual number lives in the Aadhaar Data Vault and nowhere else. A loan file that still shows the full number years later fails both.
What Aadhaar Masking does: Masked copies can be kept for the life of the loan; the vault keeps the number, the file keeps the last four digits.
RBI's Directions require exception records "available for supervisory review", and RBI fined a public-sector bank ₹1.32 crore in 2024 for failing to preserve customer-identification records. An auditor wants to know which files were masked, when, and what was found.
What Aadhaar Masking does: Every answer carries a per-page record: Aadhaar found, number masked, QR covered; the on-premises edition writes a spreadsheet for the whole run.
Loan files are phone photos of cards in plastic sleeves, faxed scans, rotated pages and photocopies of photocopies. Text-only tools fail quietly on them and log the page as "not an Aadhaar". Those pages are exactly where the number stays readable.
What Aadhaar Masking does: The engine looks at the page four ways round, reads each candidate twice and checks the checksum; 99.94% of numbers on real loan files, misses published.
Applicants write the number into forms. Sale deeds and gift deeds print both parties' numbers in running Hindi text. Maharashtra had to hide Aadhaar numbers in registered-document copies in 2024. And the QR code on older Aadhaar letters is plain XML that carries the full number.
What Aadhaar Masking does: Numbers in running text in English and Hindi, numbers split across lines, and every Aadhaar QR code, wherever it is on the page.
UIDAI's Circular 14 limits where Aadhaar data may be hosted. RBI's Digital Lending Directions require that "all data is stored only in servers located within India" and that anything processed abroad is deleted and brought back within 24 hours. Most masking APIs want your documents on their servers.
What Aadhaar Masking does: Run it inside your own AWS account from AWS Marketplace, or on your own servers. Nothing leaves. Nothing to explain.
Send a card photo, a scan or a short PDF and get it back masked by the production engine, with a per-page record of what was covered. Or book thirty minutes with a HabileLabs engineer to see it on your document types and plan a deployment in your AWS account.
Or email support@habilelabs.io · Monday to Friday, 10:00–19:00 IST (excluding public holidays)
