Card photos: mask before AI
For Aadhaar and PAN card photos, Door-Let masks detected identity numbers on its own server before AI processing. If no number is detected or masking fails, the scan stops for manual entry.
Security and privacy
Know what happens to your documents.
Door-Let asks you to photograph your renter’s identity documents. That is the largest thing we ask of you, so this page sets out exactly what happens to that image, including where the protection stops.
In brief
Three rules before the technical detail.
Leases: a different limit
Lease documents have different limits: masking is best effort, and a lease can still reach an AI provider with an identity number visible. Use manual entry for sensitive leases.
Keep the landlord in control
AI can extract or draft, but it does not send a renter message by itself.
Read the masking pipeline or go directly to the honest limits.
The risk
Reading a document can mean sharing it.
Reading a document with a third-party AI service means sending it to that provider. It matters which details remain visible on the image, not only which fields are returned.
That matters for a specific reason. An Aadhaar number is not a password you can rotate. Your renter cannot change it after a breach, and it is the key that links their identity across banks, telecom and government services. Once the image has been transmitted, you cannot unsend it, you cannot audit what the recipient retained, and you are the one who promised your renter it would be safe.
The useful question is therefore not whether a vendor encrypts data. It is whether the number is in the payload at all.
The masking pipeline
What happens to an identity-card photo
-
You photograph the card
The image is uploaded over TLS to Door-Let’s own server. Your data lives in Mumbai. Both the application server and the database sit in India.
-
We read it ourselves, first
Optical character recognition runs on our own server and returns the position of every word on the image. No third party is involved in this step, and this is the step that finds the number.
-
The number is located
Aadhaar is matched as three groups of four digits, as one unbroken twelve digit run, or hyphenated. PAN is matched as five letters, four digits, one letter. Both are looked for on every identity photo, because cards get photographed together.
-
Black rectangles are burned in
Solid black is composited onto the image itself. Not a layer that can be peeled off, not a crop that can be undone. Aadhaar keeps its last four visible and hides the rest, following the UIDAI masked Aadhaar convention. PAN hides its leading characters and keeps the tail.
-
Only the altered image leaves
The masked image, and only the masked image, is what the AI provider receives. We ask it for the name and the document type, and instruct it not to return date of birth, gender or address. The image it reads still carries them, which is why the number is removed from the image itself rather than from the answer.
-
The last four are read on our side
Door-Let reads the last four digits locally rather than asking the AI provider to extract them. A partial suffix remains visible in the masked image. The full number is not written to the masking log.
When it cannot
Failed card scans stop for manual entry.
These four cases block AI processing of an Aadhaar or PAN card image. You can enter the details manually instead. Lease documents do not share this guarantee.
- Nothing is found on an Aadhaar or PAN photo Manual entry.
- Masking throws an error Manual entry.
- The document is a PDF rather than a photo PDFs cannot be rendered and masked locally. Manual entry.
- The monthly AI budget is exhausted Manual entry.
Limits
Where this protection ends.
Masking reduces what is shared. These limits matter when you decide whether to scan a document.
Lease documents are best effort
Any Aadhaar or PAN found on a lease photo is masked the same way. But if masking fails on a lease, the lease is still sent, where an identity card would have been blocked. Lease PDFs also fall outside the local image-masking step. An identity number in a lease can therefore reach an AI provider. Use manual entry for sensitive leases.
Local OCR is a detector, not a promise
Glare, blur, unusual layouts and handwriting can defeat text detection. Card scanning stops when no number is found, but detecting one number does not prove every number in an image was found. A missed number may remain visible. Choose manual entry when you do not want to share a document with an AI provider.
In the prompt
What a provider actually receives
| Field | What the provider sees |
|---|---|
| Aadhaar or PAN number | Detected numbers are masked in card photos, with a partial suffix visible. Lease documents can retain visible numbers. |
| Renter’s name | First name only in prompts. On a scanned document, the masked image still shows the printed name |
| Phone number | Last four digits |
| Email address | Removed |
| Amount, date, unit | Sent in full |
- Every AI call is written to an append only audit log, kept 30 days by default.
- The detected identity number is never in that log, only how many regions were masked.
- The mobile app never talks to an AI provider directly. Every call goes through Door-Let’s server, which is where masking and scrubbing happen.
Questions about any of this?
If something here does not satisfy you, ask before you upload anything. We would rather answer it than have you guess.