huereo / how-it-works
You give huereo an input (one file or a folder) and a Privacy Contract that names the DPDP pack. Every release then runs the same eight steps on your own servers, and every step is recorded.
01 How a release works
Every step is recorded. Anything that needs a person stops the release instead of being guessed.
Step 1 of 8
Every supported file is read in bounded memory: each sheet of a workbook, each page of a PDF, each part of an email. A file whose name holds personal data (for example PAN_ABCPS1234K.png) is released under a neutral name such as renamed-0001.png.
Produces
02 Results
The same code comes back from the command line and the API, so a pipeline can act on it without anyone reading a report.
| Exit code | Result | What is in the output folder |
|---|---|---|
| 0 | PASS Every check passed. | release/ with the transformed copy, the RELEASE_APPROVED marker, the evidence |
| 1 | FAIL A check failed. | RELEASE_BLOCKED, the evidence, and the held-back copy in blocked/; nothing in release/ |
| 2 | UNRESOLVED A decision is needed (often the DPO’s legal decision). | RELEASE_BLOCKED, the evidence, and the held-back copy in blocked/; nothing in release/ |
| 3 | INPUT OR CONTRACT An input or contract problem; the reason names it. | Nothing is written |
| 4 | RUNTIME ERROR The run stopped with an error. | Nothing is released |
| 5 | MISSING PACK A required pack or capability is missing. | Nothing is released |
Interrupted runs. After a power loss or a killed process, huereo recover marks the run and huereo resume finishes it with the plan it had frozen. An interrupted run never leaves an approved release behind, and its working copy of the data is deleted. A second release into a folder that already holds one is refused; earlier releases are never overwritten.
03 The Privacy Contract
One YAML file, and every key in it is validated strictly: a typo stops the run before any data is read.
contracts/bank_loan_vendor_india.yamlrelease:
purpose: external_analytics
recipient_type: contracted_vendor
industry: banking
confirmed_jurisdictions: [INDIA_DPDP]
identity:
prohibited_entity_types: [NATIONAL_ID, TAX_ID,
PERSON_NAME, PHONE_NUMBER,
BANK_ACCOUNT_NUMBER, ADDRESS]
reversible_tokens_allowed: false
cross_release_linkability_allowed: false
risk:
max_residual_critical_identifiers: 0
min_k: 3
quasi_identifiers: [state, branch]
utility:
preserve_fields: [loan_amount, emi, loan_status]
preserve_relational_integrity: true
transforms:
date_policy: SHIFT
geography_level: STATE
detection:
block_on_unresolved: true
| Part | What it declares |
|---|---|
| Release | Purpose, recipient type and id; where the organisation, the data subjects, the processing and the recipient are; industry; confirmed jurisdictions. |
| Identity | Families never released raw (national IDs, PAN, names, phones, accounts and so on); whether reversible tokens and cross-release linking are allowed. |
| Risk | Maximum residual critical and high identifiers; minimum k and l; quasi-identifiers; sensitive attributes; population size. |
| Utility | Fields kept unchanged; relational integrity; time intervals; maximum distribution drift. |
| Transforms | Identity replacement: keyed tokens, or realistic stand-ins (REALISTIC); date policy (shift per person, keep month, keep year, or redact); geography level (country, state, district, postal code, locality); rules per field. |
| Detection | Whether unresolved findings block the release; the customer’s own rule pack. |
| Exceptions | Decisions by the customer’s Data Protection Officer, each with approver, date, expiry and rationale. |
| Law | The law packs the release must satisfy. |
huereo assess reads a sample and drafts a contract for it. Every identifier family it found is prohibited, fields with nothing personal are kept, and quasi-identifiers are grouped for k-anonymity. You review the draft with your privacy team.
Whether a de-identified copy is still personal data under the DPDP Act is a legal decision. huereo does not make it. Until your DPO records it in the contract (an exception of kind ACCEPT_LEGAL_REVIEW), a release ends UNRESOLVED and nothing is shared.
04 Inputs
Outputs keep the input’s format. Nothing is silently converted, and nothing a reader did not read is copied into a release. A folder releases every supported file in it.
| Input | What is read | Released as |
|---|---|---|
| CSV, Parquet | Every row and column, in batches | The same format; Parquet metadata is dropped |
| Excel (.xlsx) | Every sheet, as its own table | A workbook; text never becomes a live formula |
| JSON, NDJSON | Nested objects and arrays, streamed; keys that hold data are tokenised | The same structure |
| FHIR R4 (JSON, NDJSON, Bundles) | Element meanings for 28 resources; general rules for the others | FHIR, with resource ids and references kept consistent |
| HL7 v2 | Every field component; delimiters taken from MSH | HL7 v2 |
| SQL dumps | INSERT and COPY values | SQL |
| XML | Text, attributes and comments; DTDs refused | XML |
| Plain text and logs | The whole text | Text |
| Word (.docx) | Body, headers, footers, footnotes, comments, tracked deletions, document properties, data-bound fields, SmartArt and chart text | Word with its formatting; embedded pictures replaced by a blank, embedded files and macros emptied |
| Email (.eml) | Sender, recipients, subject, date, text and HTML bodies | Email; attachments and routing headers removed |
| Outlook (.msg) | Headers and body | Redacted text |
| HTML | Text, comments, scripts and attribute values | HTML; embedded data: images removed |
| PDF, text or scanned | Page text, and OCR for any page that holds an image | A PDF of page images with personal words painted out; no text layer, forms, attachments or metadata |
| PNG, JPEG, TIFF scans | OCR in English and Hindi | The same image format with personal words painted out; no EXIF |
05 What it finds
huereo recognises 176 types of personal and sensitive data in 42 families. Identifiers are matched with their official structure and checksum where one exists (Verhoeff for Aadhaar, Luhn for cards, ISO 13616 for IBAN), together with the labels around them in English, Hindi and European languages. Names, places and organisations in free text come from huereo’s own trained model.
Bank branch codes (IFSC, MICR, SWIFT/BIC) are recognised and kept by default: they identify a bank, not a person.
Languages
| Language | Names, places, organisations | Identifier numbers |
|---|---|---|
| English, Hinglish | Yes | Yes |
| Hindi and Marathi (Devanagari) | Yes | Yes, digits in any script |
| Bengali, Gujarati, Punjabi, Tamil, Telugu, Kannada, Malayalam | Yes | Yes, digits in any script |
| German, Spanish, Italian | Yes, measured close to English | Yes, with their local labels |
| Other scripts (Odia, Assamese, Urdu and others) | Reported as a gap, never passed as clean | Yes |
06 How data is changed
| Operation | What it does |
|---|---|
| REDACT | Replaces the value with its type, for example [PERSON_NAME] |
| MASK | Hides the value, or all but its last characters |
| SUPPRESS | Removes the value |
| TOKENIZE, HMAC | Replaces it with a keyed token; the same input gives the same token within the contract’s linking scope |
| PSEUDONYMIZE, REPLACE | Replaces it with a substitute value |
| DATE_SHIFT | Moves dates by a per-person offset, so the intervals between one person’s events are kept |
| DATE_GENERALIZE | Keeps only the month or the year |
| GEOGRAPHY_GENERALIZE | Keeps only a postal-code prefix (Indian PIN, US ZIP), or the state or country of an Indian place; anything finer is removed |
| SURROGATE | Replaces it with a realistic value of the same kind and shape; identifiers are drawn from ranges their issuer never uses |
| GENERALIZE, BUCKET | Turns exact numbers into bands (salary, marks, age) |
Generated and kept on your machine, in the state folder, with separate keys for tokens, date shifts and fingerprints. They can be rotated (huereo keys rotate) or replaced with your own key (huereo keys import). Every run pins the key ids it used, so a later rotation never changes how an old release verifies.
Off unless the contract allows them and you enable the local vault on your own machine.
Run huereo on one of your own files on a one-hour call, or start a 30-day pilot on your server (₹9,900, credited in full to your plan). Or write to hello@supermerco.com.