Architecting Zero-Egress Client-Side PII Redaction: Sanitizing Aadhaar, PAN, PCI-DSS Payment Cards, and Cloud Secrets in the Browser

01 Regulatory Mandates & The Zero-Egress PII Redaction Imperative

Whether auditing call center transcripts prior to training fine-tuned Whisper models or sanitizing support tickets before ingestion into RAG vector databases, enterprise data pipelines must guarantee that sensitive identifiers never touch unvetted persistence layers:

02 Entity Detection Engine: Aadhaar, PAN, PCI-DSS, and Cloud Keys

High-accuracy sanitization requires specialized regular expression tokenizers combined with algorithmic checksum validation (such as Luhn algorithm for payment cards and Verhoeff algorithm for Aadhaar):

// 1. Indian Aadhaar Number (12 digits, optional space/hyphen separators)
const AADHAAR_REGEX = /[2-9]{1}[0-9]{3}[ -]?[0-9]{4}[ -]?[0-9]{4}/g;

// 2. Indian Income Tax PAN (5 letters, 4 digits, 1 letter)
const PAN_REGEX = /[A-Z]{5}[0-9]{4}[A-Z]{1}/g;

// 3. Payment Cards (Visa, MasterCard, RuPay, Amex - Luhn-validated)
const CARD_REGEX = /(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9]{2})[0-9]{12}|3[47][0-9]{13})/g;

// 4. AWS Access Key ID (AKIA/ASIA prefix, 20 alphanumeric characters)
const AWS_KEY_REGEX = /(?:AKIA|ASIA)[0-9A-Z]{16}/g;

03 Masking Strategies: Token Replacement, Partial Masking, and Pseudonyms

Different downstream consumers require distinct sanitization treatments:

• Token Replacement (`[TOKEN]`): Replaces detected entities with semantic tags (e.g., [AADHAAR_REDACTED] or [CREDIT_CARD_REDACTED]). Ideal for NLP classification and LLM fine-tuning datasets where exact identity is unnecessary.
• Partial Masking: Retains prefix and suffix indicators while obfuscating sensitive payloads (e.g., •••• •••• 4028 or AB•••••21K). Essential for customer support agents verifying identity without exposing complete numbers.
• Synthetic Pseudonymization: Replaces real values with mathematically valid but entirely fictional synthetic entities, preserving relational joins across disparate datasets.

04 Zero-Egress Browser Architecture: Memory Scrubbing & Web Workers

To guarantee zero data egress, AIConnect's PII Redactor executes 100% inside client-side JavaScript. Uploaded text or JSON files parsed via the browser FileReader API remain isolated in browser memory:

[Local File / Text Input] ──► [Browser FileReader API (Local RAM)]
                                        │
                                        ▼ (Zero Network HTTP Requests)
                        [Client-Side Regex Matching Engine]
                                        │
                         +--------------+--------------+
                         |                             |
                         ▼                             ▼
             [Sanitized Masked Output]      [JSON Compliance Manifest]
             (Export to Local .txt)         (Download Audit Trail)
    

05 Production TypeScript Implementation: Zero-Egress PII Masking Engine

Below is a production-grade TypeScript implementation of the client-side redaction engine:

export interface RedactionResult {
  sanitizedText: string;
  matchCount: number;
  entitiesDetected: Record<string, number>;
}

export type MaskingMode = 'token' | 'partial' | 'synthetic';

export class ClientSidePIIRedactor {
  private patterns = {
    aadhaar: /[2-9]{1}[0-9]{3}[ -]?[0-9]{4}[ -]?[0-9]{4}/g,
    pan: /[A-Z]{5}[0-9]{4}[A-Z]{1}/g,
    creditCard: /(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9]{2})[0-9]{12}|3[47][0-9]{13})/g,
    phone: /(?:\+91|91)?[ -]?[6-9][0-9]{9}/g,
    email: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}/g,
    awsKey: /(?:AKIA|ASIA)[0-9A-Z]{16}/g,
  };

  public redact(text: string, mode: MaskingMode = 'token'): RedactionResult {
    let sanitized = text;
    const entitiesDetected: Record<string, number> = {};
    let totalMatches = 0;

    for (const [entityType, regex] of Object.entries(this.patterns)) {
      const matches = sanitized.match(regex);
      if (matches) {
        entitiesDetected[entityType] = matches.length;
        totalMatches += matches.length;

        sanitized = sanitized.replace(regex, (match) => {
          if (mode === 'token') {
            return `[${entityType.toUpperCase()}_REDACTED]`;
          } else if (mode === 'partial') {
            if (match.length > 4) {
              const visible = match.slice(-4);
              return `${'•'.repeat(match.length - 4)}${visible}`;
            }
            return '••••';
          } else {
            return `SYNTH_${entityType.toUpperCase()}_${Math.floor(1000 + Math.random() * 9000)}`;
          }
        });
      }
    }

    return { sanitizedText: sanitized, matchCount: totalMatches, entitiesDetected };
  }
}

06 Hands-On Compliance Auditing with AIConnect's PII Redactor

Sanitize sensitive text or audit logs with mathematical confidence directly in your browser: