What is Aadhaar masking?
Aadhaar masking redacts the Aadhaar number printed on a document image so that only the last four digits stay readable. The photograph, the name, the address block and the page layout are left alone. The copy still evidences what the customer submitted.
Many businesses accept an Aadhaar copy as proof of identity or address and have no reason to keep the full number afterwards. Once an unredacted copy lands in a document store, a loan file or a support ticket, you are holding data you never needed.
How the Aadhaar masking API works
Your application submits a document image and gets a redacted version back. Masking becomes part of the upload path.
Manual redaction does not survive volume. Files arrive daily from branches, field agents, a mobile app and partner handoffs, and a step that relies on somebody remembering gets missed. An automated step treats every image the same way.
The document image you send for masking
The request starts from a document image your customer or agent has already provided, usually a scan or a phone photograph of an Aadhaar letter or card. The service locates the number region and returns a masked image with the leading digits obscured.
The result depends on what the picture of the physical document shows. Skew, glare, low resolution and heavy compression all affect what can be detected. The output available for a given image may vary by document type, data source and record.
Who needs masked Aadhaar copies
- Lending and NBFCs decide at sourcing which version of an identity document enters the loan file. Branch, agent and digital channels then store the same redacted copy.
- Insurance redacts proofs collected at proposal, issuance and claim, where documents pass through intermediaries and surveyors outside the insurer's own systems.
- Fintech and payment service providers keep onboarding attachments clean as one file moves between an application, a sponsor institution and an operations queue.
- Marketplaces and gig platforms collect seller and delivery-partner documents at scale from personal devices, and rarely need the number itself.
- Staffing and background verification move candidate files between an employer, a staffing firm and a verification vendor, and every hop creates another copy.
- Real estate, healthcare and travel take an identity copy for the record, and those copies outlive the visit.
Where the masking step belongs in a document lifecycle
Deciding where the redaction step sits usually matters more than the step itself. These are the places it works:
- At capture, to keep an unmasked copy out of permanent storage.
- Before a handoff, to redact files attached to email, tickets or partner transfers.
- Across existing archives, to bring historical documents to the same standard in batches.
Fitting Aadhaar masking into your systems
The service sits inside software you already run: an onboarding journey, an agent application or a document management system. Redaction runs as a file arrives, or as a batch pass over an archive you already hold.
Keep the unmasked original out of application logs, caches and temporary buckets, because those are the copies teams forget about.
Define what happens when an image cannot be processed. A manual review queue is usually the right answer, since silently storing the original is the outcome the exercise exists to prevent.
Consent and retention when you mask Aadhaar documents
Masking is a data-minimization control and does not replace the rest of your obligations. Collect identity documents only with the customer's informed consent and for a purpose you have told them about. Keep them only as long as that purpose requires, and restrict who can open them.
Which document types and image formats you can send depends on the selected service contract.
Redaction changes what you store. It does not change your accountability for the copies you keep, who can reach them, or how long they survive.