MaskFlow

Stop Indian PII from ever reaching an LLM.

Aadhaar, PAN, GSTIN, UPI, IFSC, ABHA, Indian names and addresses — detected and replaced with reversible, typed placeholders before a prompt leaves your process, restored in the response. 28 entity types, checksum-validated where a public checksum exists, MIT-licensed, runs entirely on your own infrastructure.

⭐ Star us on GitHub — if MaskFlow is useful to you, a star helps other teams facing the DPDP deadline find it.

Why

India's DPDP Act sets a compliance deadline of 13 May 2027, with penalties of up to ₹250 crore for a breach where the required safeguards weren't in place. Every prompt sent to an LLM provider is a potential data-sharing event — and general-purpose PII tools weren't built to recognize Aadhaar, PAN, GSTIN, UPI VPAs, IFSC codes, ABHA health IDs, or Indian names and addresses reliably. Presidio already owns generic PII and is more mature everywhere else; MaskFlow exists specifically to close that gap, with accuracy that's measured and published, not asserted. See MaskFlow vs. alternatives.

Quickstart

pip install maskflow-sdk
python -m spacy download en_core_web_sm

from maskflow import mask, unmask

# Synthetic Aadhaar number: passes the Verhoeff checksum, belongs to no one.
result = mask("My Aadhaar is 2346 8907 6549 and you can reach me at alice@example.com.")
result.masked_text
# "My Aadhaar is <AADHAAR_1> and you can reach me at <EMAIL_1>."
unmask(result.masked_text, result.mapping)  # original text, restored

For a one-line wrapper around your actual LLM call, or session-scoped masking across a multi-turn agent (same value → same token for as long as the session is open), see packages/maskflow-sdk/README.md.

How it works

1. Tier-0 excision first. Deterministic regex/checksum matches (Aadhaar, PAN, GSTIN, email, credit card, ...) are found and locked in before the NER pass ever runs — spaCy parses each document at most once, only over what tier-0 didn't already claim.
2. Every match is a Span. Start/end offsets, entity type, confidence, which recognizer produced it, whether a checksum validated it, and a human-readable explanation trail. Run maskflow explain "<text>" (from maskflow-cli) to see that trail for any input, span by span — including near-misses that fell just below threshold and what config change would catch them.
3. Deterministic resolution on overlaps. Below-threshold spans are dropped; among what's left, a checksum-validated span always beats an overlapping unvalidated one, then higher confidence, then longer span, then earliest start wins — greedy, non-overlapping placement.
4. Placeholders are typed, stable, and collision-proof. <AADHAAR_1>, <EMAIL_1>, ... — the same value gets the same token within a session, and if the input text already contains something that looks like a placeholder, a nonce suffix (<AADHAAR_1_a4f9>) is used instead so a real placeholder is never ambiguous with attacke

... View full README on GitHub