credgate - R posts

Redacting Indian personal data in R before it reaches an LLM

Bharat Sikka — Fri, 06 Nov 2026 00:00:00 +0000

Redacting Indian personal data in R before it reaches an LLM¶

R users are wiring language models into their work quickly: summarising call notes with ellmer, classifying tickets, drafting replies. In a bank, an insurer or a hospital those notes are full of Aadhaar numbers, PANs and mobile numbers, and the DPDP Act, RBI guidance and plain caution all say they should not go to a model that does not need them - often not even to one running in-house on a shared server.

credgate is an R package (with a Python twin) that finds Indian personal data and takes it out before the prompt leaves your session. This post shows the R side.

Find it¶

# install.packages("credgate", repos = c("https://dwarpal.r-universe.dev", "https://cloud.r-project.org")) library(credgate) note <- "Customer name: Priya Nair. PAN ABCPN1234K, mobile +91 98765 43210, wants the EMI date moved." detect_pii(note) #> 3 PII matches (values masked; use `x$value` to see them): #> doc start end type value confidence #> 1 16 25 person_name XXXXX XXXX 0.80 #> 1 32 41 pan XXXXXX234K 0.97 #> 1 51 65 mobile_in +XX XXXXX X3210 0.97

Every match has a confidence and, if you ask, the reasons for it. These are not just patterns: an Aadhaar number must pass its Verhoeff checksum, a card number its Luhn check, a GSTIN its check character, so a mistyped or made-up number is not reported. Words nearby raise or lower the confidence: "PAN" next to a PAN-shaped value makes it near certain, "order no" next to a 12-digit number makes it unlikely to be an Aadhaar. Values are masked whenever credgate prints them, so a console log or a knitted report does not leak them either.

It reads Indian text as it is written, Devanagari digits included:

detect_pii("आधार: ५४२२ २९३७ ११८२, मोबाइल 9468451273") #> 2 PII matches (values masked; use `x$value` to see them): #> doc start end type value confidence #> 1 7 20 aadhaar XXXX XXXX ११८२ 0.97 #> 1 30 39 mobile_in XXXXXX1273 0.93

Look before you send¶

preview() shows exactly what would be replaced, and why:

preview(note, min_confidence = 0.5) #> 3 items would be redacted: #> Customer name: [PERSON_NAME]. PAN [PAN], mobile [MOBILE_IN], wants the EMI date moved. #> #> placeholder value confidence reasons #> [PERSON_NAME] XXXXX XXXX 0.80 matched Person name pattern #> [PAN] XXXXXX234K 0.97 matched PAN pattern; context 'PAN'; holder type: individual #> [MOBILE_IN] +XX XXXXX X3210 0.97 matched Indian mobile number pattern; context 'mob'

Redact, then ask the model¶

library(ellmer) safe <- redact(note, min_confidence = 0.5) safe #> [1] "Customer name: [PERSON_NAME]. PAN [PAN], mobile [MOBILE_IN], wants the EMI date moved." chat_ollama(model = "gemma3:1b")$chat(paste("Summarise in one line:", safe))

The model only ever sees [PAN] and [MOBILE_IN]. The same works with chat_openai(), chat_anthropic(), chat_vllm() or any other provider: credgate runs before the request, in your R session, and makes no network calls of its own.

Need the real values back? Tokenise¶

Redaction is one-way. When the answer should contain the real values - a drafted reply to the customer, say - tokenise instead: the model sees numbered tokens, and restore() puts the values back into its answer.

vault <- cg_vault() tokenise(note, vault, min_confidence = 0.5) #> [1] "Customer name: [PERSON_NAME_1]. PAN [PAN_1], mobile [MOBILE_IN_1], wants the EMI date moved." answer <- "Dear [PERSON_NAME_1], your request to move the EMI date for PAN [PAN_1] is noted." restore(answer, vault) #> [1] "Dear Priya Nair, your request to move the EMI date for PAN ABCPN1234K is noted."

The vault stays in your session; vault_save() writes it encrypted with a passphrase if you need it later.

Data frames¶

Before a table goes into a prompt, a RAG index or a shared file, find out which columns hold personal data:

calls <- data.frame(  id = 1:4,  cust_pan = c("ABCPE1234F", "AAACR5055K", "XYZPQ9876R", "BNZPM2501F"),  notes = c("Called, Aadhaar 2345 6789 0124", "no issues", "mobile 9876543210", "asked about EMI") ) scan_pii(calls) #> Scanned 3 columns; PII found in 2: cust_pan and notes #> column type rate matched whole confidence example #> cust_pan pan 100% 4 of 4 4 0.97 XXXXXX234F #> notes aadhaar 25% 1 of 4 0 0.97 XXXX XXXX 0124 #> notes mobile_in 25% 1 of 4 0 0.93 XXXXXX3210

For tables too big for memory, the same functions work on Arrow datasets, Parquet files, DuckDB and other databases through DBI, and Spark through sparklyr, sampling where the data lives. See large data.

What it does not do (yet)¶

Names in running text. credgate finds names after a title, label or relation ("Smt.", "Name:", "S/o"), not in a sentence like "Delivery to Sandeep Pillai". If you know a column holds names, say so and every value is read as one; for notes, add your own name list or cues as a custom detector.
Evasion. It handles accidental variation - Indic digits, hidden characters, mixed case - not someone deliberately spelling a PAN out letter by letter.

Going further¶

Policies: which models may see what, decided by InfoSec in one YAML file and applied with policy_apply(); every decision can go to a tamper-evident audit log.
A proxy (from the Python package) applies the same policy to every request from Claude Code, Copilot Chat or ellmer pointed at it.
How a match is scored, step by step.

credgate is open source (Apache-2.0) and alpha: we are looking for people to try it and tell us what it misses. Report a detection problem with a synthetic example, or start a discussion.

All values in this post are synthetic.

A Shiny app for InfoSec: which models may see which data

Bharat Sikka — Fri, 06 Nov 2026 00:00:00 +0000

A Shiny app for InfoSec: which models may see which data¶

Once a bank lets analysts use language models, someone has to decide which models may see what. Customer PANs to the in-house model on the analyst's laptop: probably fine. To a shared GPU server: perhaps not. To an external provider: no. A card number with its CVV: never. That someone is usually InfoSec or compliance, and they should not have to edit YAML to say it.

credgate keeps these decisions in a policy, and its R package includes a Shiny app to edit one. This post walks through it.

The policy¶

A policy lists the model endpoints requests may go to, each with a tier - local (the analyst's machine), internal (models the organisation runs) or frontier (external providers) - and rules, checked in order, that decide what happens to each identifier found: allow it, redact it, tokenise it, or block the whole request.

library(credgate) policy <- cg_policy("bank-default.yaml") d <- policy_decide(policy, "Card 4111 1111 1111 1111, CVV 123, expiry 08/29", "claude") d$allowed # FALSE d$blocked_by # "card-with-cvv-and-expiry"

Loading is strict: an unknown field, tier or identifier type is an error, never a silent "allow".

The editor¶

# install.packages(c("shiny", "bslib")) policy_editor("bank-default.yaml")

Endpoints and Rules: add, change, reorder. The first rule that matches decides, so order matters; moving a rule shows straight away what changes.
Try it: paste a synthetic sample, pick an endpoint, and see the decision on the unsaved policy - each identifier, its confidence, why it was found, the action and the rule that decided it. It also lists what looked like an identifier but was not reported, and why (a failed checksum, a missing keyword, a confidence below the minimum).
Tests: once a decision is right, save it as a test. Every later change runs the tests first; a change that breaks one cannot be saved without saying why.
Detectors: write and try custom detectors - loan account numbers, staff codes - with a form that generates the YAML.
Changes: what differs from the saved file, and the change log.

Tests: the behaviour that was agreed¶

# bank.tests.yaml, beside the policy kind: credgate-policy-tests version: 1 tests:  - id: card-blocked-for-claude  endpoint: claude  text: Card 4111 1111 1111 1111, CVV 123, expiry 08/29  expect: {allowed: false, blocked_by: [card-with-cvv-and-expiry]}

run_policy_tests("bank.yaml")[, c("id", "passed")] #> id passed #> 1 card-blocked-for-claude TRUE

The same tests run in CI with credgate policy test, and the proxy refuses to load a new policy revision whose tests fail.

Every save is on record¶

Saving raises the policy's revision and appends who saved it, when, why and what changed to a change log beside the policy. Each entry carries the hash of the one before, so an entry edited or removed afterwards is detected.

x <- yaml::read_yaml("bank.yaml") x$destinations$copilot$blocked <- FALSE policy_diff(yaml::read_yaml("bank.yaml"), x) #> [1] "endpoint copilot: blocked true -> false" policy_write(x, "bank.yaml", user = "priya", note = "CHG-1042 Copilot approved for code") h <- policy_changes("bank.yaml") h[, c("revision", "user", "note")] #> revision user note #> 1 2 priya CHG-1042 Copilot approved for code attr(h, "intact") #> [1] TRUE

For a whole team¶

With a users file, the editor shows each person what their role allows, and refuses the rest on the server:

admins (InfoSec) change the policy;
auditors see everything and change nothing;
users (analysts) try the saved policy, see the tests and their own activity, and manage their own key for the credgate proxy - but not the policy's make-up.

Behind single sign-on (OAuth2 Proxy, Keycloak, a web server's SSO module), the signed-in name comes from a header: see the deployment guide. The editor loads nothing from the internet, so it runs air-gapped.

The Python package has the same app (credgate editor), on the same files, for teams without R.

Try it¶

credgate is open source (Apache-2.0) and alpha. If you look after AI governance or data protection, we would like to hear what is missing: open a discussion or an issue.

Install from R-universe (CRAN review in progress)
The policy editor guide

All values in this post are synthetic.