LatAm Spanish PII Redaction 0.2.0 — identifiers-only release

Version 0.2.0; the private SageMaker package is certified for Marketplace. The owner approved the documented sources, license boundaries, limitations and commercial terms. Consult the Marketplace offer for current availability. This release narrows the product to deterministic identifier/email candidate redaction. It is not an identity verifier, complete anonymizer or compliance guarantee. PERSON/ADDRESS research remains separate and is not included or activatable in this release.

Release capability boundary

The country scope is Mexico, Chile, Argentina, the Dominican Republic and Colombia. Eight primary identifier types plus email syntax are in scope:

Output type Candidate coverage Implemented validation boundary
AR_CUIT CUIT/CUIL Eleven-digit arithmetic for supported prefixes; no issuance or gender inference.
AR_DNI DNI Candidate/structure checks; no universal checksum claimed.
CL_RUT RUT/RUN Seven/eight-digit-body modulus-11 arithmetic with K/0 handling; no issuer verification.
CO_CEDULA Cédula Candidate/structure checks; no universal checksum claimed.
CO_NIT NIT Arithmetic for a nine-digit body only; other lengths remain unverified.
DO_CEDULA Cédula Eleven-digit structure only; checksum and historical exceptions remain unverified.
MX_CURP CURP Implemented 18-character structural/date checks; checksum remains unverified.
MX_RFC RFC Partial arithmetic for 12/13-character forms; generic and ambiguous remainder cases remain unknown. No homoclave assignment.
EMAIL Email-address syntax No mailbox ownership or deliverability verification.

AMBIGUOUS_ID is an additional protective, unverified emission when country attribution is unresolved. GENERIC_ID is not emitted by this identifiers implementation and is not advertised as current support. AMBIGUOUS_ID does not add country-specific validation support. Its detected candidates remain masked/transformed and disclosed in outputs. Every actual emitted type stays in acceptance scoring; no fallback is remapped or dropped to improve a metric.

The release container locks an immutable identifiers-only profile and excludes neural modules, dependencies, tokenizers and weights. Non-off NER overrides are rejected before activation. Direct development sources or separate research branches are not a way to expand this release's supported scope. Buyer instructions do not enable neural processing.

Names, addresses, phones, bank/card data, passports, other national schemes and unmatched identifiers may remain in text. Recognized invalid, masked, generic and unverified candidates remain redacted; detection is deliberately broader than successful validation and is not exhaustive.

Output and privacy contract

Four modes are retained:

Entity metadata contains offsets and validation evidence, not raw matched values. The application does not log request bodies. Operators remain responsible for access, downstream logging/storage and review of unmatched content. Pseudonymization is linkable and is not anonymization.

Hash mode requires a high-entropy, operator-managed server secret of at least 32 UTF-8 bytes. Requests cannot supply or override it. Provision and rotate through approved secret-management controls outside notebooks and source code. Matching exact text/types share pseudonyms under one key; case, separator or key changes alter them. Do not infer identity verification from a consistent token.

Offsets are zero-based, end-exclusive Unicode code points in unchanged input, not bytes or UTF-16 indices. Intersecting detections use interval union to preserve covered suffixes. The strongest supported source determines the output type; merged_types records overlaps. validation_scope may state that checks applied to a candidate before a wider union.

Validation evidence and limitations

syntax_valid reflects only implemented structure checks. valid_checksum is true/false for supported arithmetic and null when unknown. Identifier issuer_verified remains false. Successful arithmetic does not prove assignment, authenticity, ownership or compliance; failed/unknown checks do not stop redaction.

The identifier source review records supported prefixes, lengths, remainder behavior, provenance limits and application/base-image license boundaries. RFC remainder cases 1/10 remain unknown; documented generic RFCs remain redacted with unknown personal checksum status. CURP/DO arithmetic is not guessed. No CUIT/NIT checksum is reused as a universal DNI/cédula validator. Broader formats and source currency/applicability need review.

Country hints auto, MX, CL, AR, DO, CO can enable bare numeric candidates or resolve cédula ambiguity. They can over-redact ordinary numbers and never filter explicit foreign IDs. Auto mode can miss unlabelled numbers. Unlabelled CO NIT, arbitrary whitespace/zero-width insertion, OCR errors, historical variants and some partial masks remain detection limits.

Transport and limits

JSON records/arrays, an instances envelope, JSON Lines, plain text and strict one-column CSV with text header are accepted. Limit: 256 KiB UTF-8 body, 1–16 records, 16,000 code points each and 64,000 total. Record fields are text, mode, country_hint; unknown fields fail. All records are validated before prediction and no partial batch output is returned on failure.

JSON arrays/envelopes/CSV return a predictions envelope; JSON Lines returns one result per nonempty line. The HTTP server uses generic errors, eight accepted handlers, one active inference and a five-second read timeout. SageMaker scheduling hints do not override the smaller application payload cap. /ping reports readiness. Deploy only within an authenticated service boundary.

Evidence status for this candidate

These results bind to the identifiers-only 0.2.0 release: application image sha256:9282919119d5ce14acab60d91546215453f09eaacaa18157ac8dc092785d9060, registry manifest sha256:980e3633a2b48a71d051c24bd308afbc25e19ec912386f0a8d0975f1e77f0ab4. Results for older images are not substituted.

Evidence Observed outcome and boundary
Repository checks 480 tests passed, five existing encoder-dependent skips (including publication tooling checks).
Actual final image, local HTTP 1,168 checks passed, including immutable profile and license checks. Local checks do not establish AWS performance or population accuracy.
Independent post-freeze V4 synthetic evaluation 600/600 exact documents; 50 examples for each of eight primary ID types, 40 AMBIGUOUS_ID spans, 120 EMAIL spans and 160 no-national-ID controls (32 EMAIL-only, 128 entity-empty). Per emitted type: zero FP/FN; zero expected-value leaks across mask/replace/hash. Strata can overlap within a document.
Private SageMaker realtime, ml.c5.xlarge Observed request-latency p95 11.092112 ms on exact 1,000-code-point inputs over 200 observations and three positive fixtures, measured from AWS-region Lambda with warmups excluded; additional 120 mixed requests and 40 concurrent requests. Network isolation enabled. This is a narrow-fixture measurement, not a latency SLA or broad workload estimate.
Private SageMaker Batch Transform, ml.m5.large 13 cases completed with exact spans/masks. This small functional check is not a throughput benchmark.
Private package certification Completed and certified for Marketplace for the exact registry digest; this is not a public listing.

V4 was independently authored after model freeze using frame-based AI generation. Its values/documents were disjoint from 1,729 prior cases. There was no human review; independent authorship and disjoint values do not make synthetic frames representative of real identifiers, OCR noise, writing styles or customer populations. The observed zero-error result is not a guarantee of zero leaks on other inputs.

Earlier 440- and 600-document acceptance attempts failed, were rejected and promoted to development diagnostics. They remain historical failures, not acceptance evidence for the final candidate. The historical 289-document regression was also inspected during fixes and is not an independent holdout. No earlier result is silently relabelled as a pass.

The intended primary-ID detection floors remain per-type precision ≥0.99, recall ≥0.97 and zero supported-ID leakage. V4 met those floors on its synthetic set only, including every emitted fallback/email type. Documented unknown checksums remain unknown. PERSON/ADDRESS quality is outside this candidate, not silently passed.

The owner approved the documented sources, licenses, limitations and USD 0.50 per instance-hour and a 14-day software trial. Exact-image security, private package certification and public English buyer delivery passed. Marketplace listing availability is a separate Catalog publication step. Human review and representative permitted workload evaluation remain necessary for broader quality claims. The current synthetic and narrow AWS results do not substantiate broader quality claims. The owner separately authorized publication after reviewing these limitations.

Approved offer terms

Approved software rates are $0.50 per ml.m5.large software instance-hour and $0.50 per ml.c5.xlarge software instance-hour, with a 14-day software trial. AWS infrastructure and other AWS charges are separate, including during a software trial. These terms are configured for this new product; existing products retain their own offers. Subscription availability depends on Marketplace publication status. Final Marketplace terms govern.

See usage, the synthetic notebook and identifier sources. These assets do not deploy resources or establish representative population accuracy.