Saaf
LiveApache-2.0India-first PII masking and restore for LLMs. Catches Aadhaar, PAN, GSTIN, UPI and 18 more identifiers with checksums, and puts the real values back in the reply, even mid-stream.
physicsisawesome7/Saaf
AI safety & trust lab · India
Making AI safe to use on real Indian data.
Safearly builds open-source guardrails, benchmarks and research for teams putting LLMs and AI agents to work on Aadhaar, PAN, UPI and everyday Hinglish. Measured in public. Built in India.
Open source · Apache-2.0 · Runs on your infrastructure
You send
Mera aadhaar 2345 6789 0124 hai, PAN ABCPE1234F
The model sees
Mera aadhaar [AADHAAR_1] hai, PAN [PAN_1]
You get back
Verified 2345 6789 0124 and ABCPE1234F.
Saaf · masked in your browser or gateway · restored mid-stream
Focus areas
Three problems we think India has to solve first.
Privacy for LLMs
Personal data leaks into prompts, logs and retrieval stores. We mask it before it leaves your network and restore it in the reply.
Agent security
Agents act through tool calls, and that is where data walks out. We are researching guardrails that check every call before it runs.
Evaluations for India
Most safety benchmarks are English-only. We build open benchmarks in Hinglish and Indian scripts and publish every number, including the ones we lose.
Products & open source
Things we ship, and things we are still testing.
IndicPII-Bench
LiveApache-2.0An open benchmark for detecting Indian personal data: 2,500 documents across structured IDs, Hinglish, four Indian scripts and look-alike numbers that should be left alone.
physicsisawesome7/Saaf/bench
Saaf Guard
In researchGuardrails for AI agents: allow-lists, argument checks and human approval for risky tool calls, with signed evidence of what was allowed and why.
Indic name model
In researchA small model that finds Indian names and addresses in Indian scripts and code-mixed text, where every tool we tested, including ours, scores near zero today.
Benchmark · IndicPII-Bench v1
Measured against Microsoft Presidio, in public.
0.711 vs 0.437strict F1, Saaf vs Presidio with its India recognizers on and tuned
0.35 vs 131false alarms per 1k tokens on look-alike numbers
44×faster per kilobyte on the same machine
0.1 vs 691 MBinstalled size, Saaf vs Presidio + spaCy
Most of the corpus is synthetic and Saaf's rules were tuned on the same families, so read Saaf's scores as optimistic until our human-labelled set is out. Names in Indian scripts remain unsolved for every tool, including ours.
Writing
Notes from the lab.
A checksum is not enough: detecting Indian PII in the real world
About one random 12-digit number in ten passes the Aadhaar checksum. Why detection needs labels, scripts and OCR repair.
Read →Agents need a firewall
Prompt injection is admitted to be unsolved. In every major agent leak of the past year, the data left through a legitimate tool call.
Read →India's AI trust rulebook, for builders
DPDP, the Aadhaar Data Vault, CERT-In and RBI's FREE-AI: what is in force, what is draft, and what applies to your LLM app.
Read →Principles
How we build.
Open by default
Code, benchmarks and data are public under permissive licences.
Measured in public
Every claim comes with a number, a method and a way to reproduce it.
Honest about limits
We say what our tools miss, and label research as research.
Private by design
Our tools run on your infrastructure. We never see your data.
Founder
Lalit Shukla
Chief of Product · Product-driven entrepreneur
Six years of building AI products for India's infrastructure and government, from drone analytics for NHAI and NTPC to automated project reports for railways and highways.
Putting AI on Indian data?
Pilots for Saaf, research collaborations and partnerships. Tell us what you are building.