Skip to content

Detection

Redacting Indian personal data in R before it reaches an LLM

R users are wiring language models into their work quickly: summarising call notes with ellmer, classifying tickets, drafting replies. In a bank, an insurer or a hospital those notes are full of Aadhaar numbers, PANs and mobile numbers, and the DPDP Act, RBI guidance and plain caution all say they should not go to a model that does not need them - often not even to one running in-house on a shared server.

credgate is an R package (with a Python twin) that finds Indian personal data and takes it out before the prompt leaves your session. This post shows the R side.

Four Indian PII detectors on three datasets, including ones we did not write

Every PII tool looks good on its own test data. credgate's benchmark has always been a corpus we generated ourselves, and our rules were refined on part of it - so its numbers say more about our templates than about the notes, logs and chat transcripts a bank actually has.

So we ran credgate, MaskFlow, Microsoft Presidio and Kavach PII on two public Indian PII datasets written by other people, alongside our own, with the same scoring for every tool. This post is what we found: where credgate is strong, where it clearly trails, and the three detection fixes the public data led to.