PrivoNest combines a layered multilingual privacy engine with a separate API Security Engine for AST, cross-file route/data-flow analysis and private dependency intelligence.
The engine reports NFKC + native-digit + script canonicalization so matching is less dependent on how a user typed the same identifier.
Automatic inference uses scripts, language signals, aliases, calling codes, TLD-style hints and strong identifiers to activate relevant recognition packs.
Deterministic patterns and validators handle structured IDs while optional spaCy NER helps with names and organizations. Rules carry priority, confidence and context controls.
The capabilities endpoint exposes validators including Luhn, IBAN, CPF/CNPJ, DNI, national IDs, tax identifiers and other country-specific checksum families.
Choose label masking, redact, partial, hash, tokenize, detokenize or remove. The engine also contains a format-preserving replacement path for applicable internal workflows.
JSON path policies, spreadsheet column policies, DOCX run-aware changes, PDF/image OCR, email/DICOM processing and transcript handling avoid forcing every workload into plain text.
Use the live capabilities endpoint instead of relying on marketing copy for exact runtime coverage.
The security engine is separate from the PII engine. It receives logical project files through the authenticated preflight API, builds code/route context, runs detector passes, reads private dependency intelligence and returns findings without using an external AI model.
Python AST plus dependency-free ordered JS/TS structural traces identify sources, sinks, validation boundaries and route logic.
Resolve local imports/router mounts and inherited authentication, authorization and rate-limit context across Flask, FastAPI and Express-style projects.
Security checks cover API logic, unsafe data flows, injection/configuration signals, debug bypasses, secrets and dependency risks.
Customer scans query PrivoNest-owned snapshot data rather than live npm/PyPI endpoints, reducing source/dependency metadata exposure during the scan.
Repeated fields/routes are grouped with related-location metadata, while runtime-sensitive findings outside known entrypoint/import chains are retained as dormant risk at a lower effective severity.
Compare new/fixed/unchanged findings, enforce severity/confidence policy and export JSON or SARIF for CI tooling.