A common myth is that verifying someone against Aadhaar means storing their Aadhaar number. It doesn't — and it shouldn't. Good verification is built around never holding the full number at all.
What masking means
Masking shows only the last four digits (e.g. XXXX XXXX 1234) and keeps the full 12-digit number out of your systems. In offline verification, the artefact the resident shares carries a reference ID rather than the full number, so there's nothing to mask — it was never there.
How you verify without storing it
Online (AUA/KUA) returns a yes/no and signed attributes; offline (OVSE) gives you a UIDAI-signed record with a reference ID and the attributes you need. In both, you keep the result and the minimum details — not the number.
Why it matters
- Data minimisation — you can't lose or leak what you never stored.
- DPDP-aligned — purpose-limited, consent-first handling.
- Lower risk — a breach of your visitor log doesn't expose Aadhaar numbers.
See the DPDP Act and visitor data. Certopact Entry never stores the full Aadhaar number by design. General information, not legal advice.