KavachAI: A Privacy-Preserving Desktop System for Multimodal Sensitive Data Detection and Redaction

Abstract

Sensitive information can appear in text documents, images, and audio recordings, making it difficult for users to protect personal data before sharing digital content. This paper presents KavachAI, a Windows desktop application designed to integrate multimodal sensitive-data detection, redaction, and protected local storage within a unified workflow. The system combines regular-expression matching and named-entity recognition (NER) for text analysis, optical character recognition (OCR) for extracting text from images, and locally executed speech-to-text transcription for processing audio recordings. Extracted text from images and audio is passed through a shared detection pipeline to identify configured sensitive-data patterns and supported named entities. The application provides text masking, visual image redaction, and protection of audio-derived transcripts. Selected retained outputs are encrypted using AES-256 in Galois/Counter Mode (AES-256-GCM), while the Windows Data Protection API (DPAPI) protects the associated encryption key. SQLite supports local application data and scan-history management. The system is implemented using Electron, React, and a locally hosted FastAPI backend with Python-based processing components. This paper describes the system architecture, implementation, privacy boundaries, and functional verification approach. Quantitative evaluation of detection accuracy, processing latency, and redaction completeness requires a separately documented and controlled assessment.

Introduction

KavachAI is a Windows desktop application designed to detect and protect sensitive personal information in text documents, images, and audio recordings. With the increasing use of digital communication and electronic files, protecting information such as names, phone numbers, email addresses, residential details, and identification numbers has become essential. Manual identification and removal of such information can be time-consuming and error-prone, especially when data appears in multiple formats.

The proposed system combines Regular Expressions (RegEx), Named-Entity Recognition (NER), Optical Character Recognition (OCR), and speech recognition to detect sensitive information across different media. RegEx identifies structured patterns such as phone numbers and email addresses, while NER detects contextual information such as names, organizations, locations, and dates.

KavachAI processes different types of input through specialized workflows. Text documents are analyzed directly using the shared detection pipeline. Images are processed using OpenCV and Tesseract OCR to extract text and identify its location for visual redaction. Audio recordings are transcribed into text using a locally executed Whisper model, after which the transcript is analyzed for sensitive information. The system can protect text through masking, images through blurring, pixelation, or opaque masks, and audio-derived transcripts through text protection. It does not directly remove sensitive speech from the original audio recording.

The application uses Electron, React, and Vite for the desktop interface, with a locally hosted FastAPI backend for processing. SQLite manages local application data and scan history. Selected retained outputs are encrypted using AES-256-GCM, while Windows Data Protection API (DPAPI) protects the associated encryption key.

The literature review highlights the complementary strengths and limitations of the technologies used. RegEx and NER may miss certain sensitive information, OCR can misrecognize characters or locations, and speech recognition can produce inaccurate transcripts. Therefore, detection and redaction results require validation to ensure that sensitive information has been properly protected.

The main research gap is the lack of an integrated workflow that combines sensitive-data detection, extraction, redaction, and local data protection across text, images, and audio. KavachAI addresses this gap by bringing these capabilities together in a single desktop application.

Conclusion

This paper presented KavachAI, a privacy-oriented desktop application designed to detect and redact sensitive information from text, images, and audio-derived transcripts. The system integrates multiple processing techniques within a unified desktop environment to support the identification and protection of potentially sensitive information before digital content is retained or shared. For text processing, KavachAI combines regular-expression matching with named-entity recognition to identify configured patterns and supported contextual entities. For image processing, optical character recognition extracts text from images so that sensitive information can be detected and visually redacted in the corresponding image regions. For audio processing, locally executed speech-to-text transcription converts speech into text that can be analyzed using the shared detection pipeline. The resulting transcript can be masked or protected; however, the original audio waveform is not directly redacted by the current workflow. The application uses Electron and React for the desktop interface, a locally hosted FastAPI backend for processing requests, Python-based detection components, and SQLite for local application data and scan-history management. AES-256-GCM is used to encrypt retained outputs where encryption is implemented, while the Windows Data Protection API (DPAPI) protects the associated encryption key. These mechanisms provide a foundation for local data protection without requiring a cloud-based processing service as part of the intended core workflow. The main contribution of KavachAI is the integration of text detection, image OCR-based redaction, audio transcription, and protected local storage into a single desktop application. Rather than treating each modality as an independent workflow, the system reuses the text-detection pipeline for text extracted from images and audio recordings. This design supports a more consistent approach to identifying sensitive information across different forms of digital content. Nevertheless, the effectiveness of the system depends on the quality of the input, the coverage of configured detection patterns, the performance of the underlying models, and the accuracy of mapping detected information to its original location. OCR and speech-recognition errors may affect subsequent detection, while named-entity recognition and rule-based matching may produce false positives or miss sensitive information. Encryption and local processing also do not, by themselves, guarantee complete protection against every possible threat. Functional testing was carried out during development. The developer reports that the five principal workflows listed in Table II were tested; however, the available manuscript does not include a complete set of raw test records or quantitative measurements sufficient to establish detection accuracy, processing speed, or redaction completeness. These properties require a documented, reproducible evaluation and are not claimed as measured results in this paper. In conclusion, KavachAI demonstrates an integrated engineering approach to multimodal sensitive-information detection and redaction in a desktop environment. Its architecture provides a basis for further development in detection reliability, redaction verification, security assessment, and usability.

References

[1] National Institute of Standards and Technology, Advanced Encryption Standard (AES), FIPS PUB 197-upd1, May 2023. [Online]. Available: https://doi.org/10.6028/NIST.FIPS.197-upd1 [2] M. Dworkin, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, NIST Special Publication 800-38D. Gaithersburg, MD, USA: National Institute of Standards and Technology, Nov. 2007. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-38D [3] A. Radford, J. W. Kim, T. Xu, G. Brockman, C. McLeavey, and I. Sutskever, “Robust speech recognition via large-scale weak supervision,” arXiv preprint arXiv:2212.04356, 2022. [Online]. Available: https://arxiv.org/abs/2212.04356 [4] R. Smith, “An overview of the Tesseract OCR engine,” in Proceedings of the Ninth International Conference on Document Analysis and Recognition (ICDAR), vol. 2, 2007, pp. 629–633, doi: 10.1109/ICDAR.2007.4376991. [5] Explosion AI, “spaCy: Industrial-strength Natural Language Processing in Python,” spaCy documentation. [Online]. Available: https://spacy.io/. [Accessed: Oct. 24, 2026]. [6] Microsoft, “CryptProtectData function (dpapi.h),” Microsoft Learn. [Online]. Available: https://learn.microsoft.com/en-us/windows/win32/api/dpapi/nf-dpapi-cryptprotectdata [7] Microsoft, “Data Protection API (DPAPI),” Microsoft Learn. [Online]. Available: https://learn.microsoft.com/en-us/windows/win32/secauthn/data-protection [8] Electron, “Introduction,” Electron Documentation. [Online]. Available: https://www.electronjs.org/docs/latest/ [9] FastAPI, “FastAPI documentation.” [Online]. Available: https://fastapi.tiangolo.com/ [10] Tesseract OCR, “Tesseract Open Source OCR Engine.” [Online]. Available: https://github.com/tesseract-ocr/tesseract

Copyright

Copyright © 2026 Dr. Sreenivasa Murthy V, Charan S. N. , Madan Gowda R. , Venu B. S. , Vinay V. Y. . This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.