AI-Powered Secure Document Anonymization Pipeline: A Serverless AWS Architecture for PII Detection and Redaction

AI-Powered Secure Document Anonymization Pipeline: A Serverless AWS Architecture for PII Detection and Redaction Shiva Sai Peddy Birla Institute of Technology And Science, Pilani November 2025 Abstract Organizations struggle with manual redaction of Personally Identifiable Information (PII) from sensitive documents, facing significant compliance challenges with GDPR and HIPAA regulations. This work develops an intelligent, serverless document anonymization pipeline using Amazon Web Services to automate PII detection and redaction processes. The solution employs AWS Step Functions to orchestrate a microservices architecture that ingests documents through a secure web interface, extracts text using Amazon Textract, identifies sensitive information via Amazon Comprehend, and applies configurable anonymization strategies. The system integrates multiple AWS services including Lambda functions for processing logic, API Gateway for API communication between frontend and backend, S3 for storage, DynamoDB for audit trails, and EventBridge for workflow management. Key features include a JavaScript-based frontend with real-time progress tracking, support for multiple document formats (PDF, TXT, and images), and intelligent PII detection covering names, Social Security numbers, emails, medical information and other sensitive PII. Security measures encompass malware scanning via GuardDuty, encryption at rest and in transit, fine-grained IAM policies, and comprehensive audit logging via CloudTrail. The serverless architecture ensures cost-effectiveness through pay-per-use pricing while providing automatic scaling capabilities. This implementation showcases a practical application of cloud-native architectures and AI services for solving real-world data privacy challenges in enterprise environments. 1 Introduction 1.1 Background and Problem Statement In a data-driven world, organizations manage vast quantities of sensitive digital documents, including customer records, financial statements, medical reports, and legal contracts. Manually identifying and redacting Personally Identifiable Information (PII) or other confidential data in these documents is labor-intensive, error-prone, and not scalable. This problem is compounded by strict global data privacy regulations such as GDPR, HIPAA, and CCPA, which require tight controls over sensitive information. Non-compliance can result in severe penalties, reputational damage, and loss of customer trust. A critical need exists for innovative, automated solutions that can efficiently and securely process and anonymize sensitive content at scale. This project proposes an AI-powered serverless pipeline as a transformative solution to this significant industry requirement. 1.2 Purpose and Objectives The purpose of this project is to build and validate an automated, AI-powered secure document anonymization pipeline using AWS. Key objectives include: 1 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline •Understanding industry challenges and regulatory requirements •Designing a resilient serverless architecture •Implementing advanced AWS AI services for sensitive data detection •Developing automated anonymization logic with high accuracy •Embedding robust end-to-end security measures •Orchestrating complex workflows with Lambda and Step Functions •Implementing retry mechanisms for failed scans •Validating performance and compliance requirements •Providing ongoing monitoring and alerting capabilities •Developing a user-friendly web application for document anonymization 1.3 Scope and Limitations The scope of this project encompasses the design, implementation, and validation of a proof-ofconcept for an AI-Powered Secure Document Anonymization Pipeline. The prototype demonstrates an end-to-end automated workflow that securely ingests various document types (TXT, PDF, images), performs automated malware scanning, leverages AI for sophisticated content extraction and sensitive data identification, and programmatically replaces sensitive elements with anonymized placeholders. The anonymized documents are stored securely with controlled access mechanisms via pre-signed URLs. Current Limitations: 1. AWS Lambda limits execution time, memory, and payload size, restricting processing of large or complex files 2. Document layout preservation can be imperfect for tables, diagrams, and figures 3. File export formats are limited to TXT and PDF only 4. Some complex document formats may not be fully supported 1.4 Literature Review 1.4.1 Serverless Computing and Cloud Data Processing The evolution of serverless computing has significantly transformed modern cloud-based applications, particularly in data processing workflows. Jonnakuti (2025) demonstrates the integration of Amazon EventBridge and AWS Step Functions for intelligent orchestration of real-time AI business pipelines, highlighting the potential for event-driven architectures to enhance automation and responsiveness in complex data workflows. This serverless paradigm offers substantial benefits in terms of cost optimization, automatic scaling, and reduced operational overhead compared to traditional server-based approaches [1]. Complementing this perspective, Poorvadevi et al. (2025) provide comprehensive operational analyses of serverless computing on cloud platforms, emphasizing its effectiveness in handling dynamic workloads and achieving cost-efficiency through pay-per-use models [2]. Their studies reveal that serverless architectures can significantly reduce infrastructure management complexity while maintaining high performance for data processing tasks. The research demonstrates that serverless solutions are particularly well-suited for applications with unpredictable traffic patterns and varying computational demands, making them ideal for document processing pipelines where workloads can fluctuate significantly [3]. 2 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline 1.4.2 AI-Driven Sensitive Information Detection and Anonymization The field of personally identifiable information (PII) detection and anonymization has witnessed remarkable advancements through the integration of artificial intelligence and machine learning techniques. Mishra et al. (2025) present a groundbreaking hybrid approach that combines rule-based natural language processing with machine learning algorithms for PII detection and anonymization in financial documents. Their methodology achieves superior accuracy compared to traditional rule-based systems alone, demonstrating the effectiveness of combining deterministic rules with adaptive ML models to handle diverse document formats and content variations [4]. Building upon AI-powered healthcare applications, Pavithra and M (2025) explore the implementation of Amazon Bedrock for medical data processing, showcasing how advanced AI models can be leveraged for sensitive healthcare information handling while maintaining privacy and compliance standards. Their work illustrates the growing importance of domain-specific approaches to PII detection and anonymization, particularly in regulated industries where data sensitivity requirements are paramount [5]. Gao and Li (2024) focus specifically on AI-empowered sensitive information detection and anonymization in PDF files, addressing the unique challenges posed by unstructured document formats. Their research demonstrates how computer vision and natural language processing techniques can be combined to extract, identify, and anonymize sensitive data from complex document layouts, extending beyond simple text-based detection to handle mixed content types including images, tables, and formatted text [6]. 1.4.3 Enterprise-Level Security and Compliance The detection and remediation of sensitive information in enterprise environments has become increasingly critical as organizations face growing security threats and regulatory requirements. Kerr et al. (2025) investigate the use of AI and machine learning technologies for finding and remediating enterprise secrets in code and document sharing platforms, highlighting the challenges of maintaining security across diverse organizational tools and workflows. Their work emphasizes the need for comprehensive, automated solutions that can monitor multiple data sources simultaneously while minimizing false positives and operational disruption [8]. Shukla et al. (2024) contribute to the field by presenting context-based approaches for effective password detection in plaintext, demonstrating how contextual analysis can improve the accuracy of sensitive information identification. Their work highlights the importance of considering semantic context rather than relying solely on pattern matching, which can lead to both false positives and missed detections in real-world scenarios [7]. 1.4.4 Privacy-Preserving Pipeline Architectures Chakraborty et al. (2025) present SPIDEr, a secure pipeline for information de-identification that incorporates end-to-end encryption, representing a comprehensive approach to privacypreserving data processing. Their architecture demonstrates how multiple security layers can be integrated into a cohesive system that maintains data utility while ensuring privacy protection throughout the entire processing lifecycle. This work is particularly relevant for understanding how encryption, anonymization, and secure communication protocols can be combined to create robust privacy-preserving systems [9]. The integration of these various research contributions reveals a clear trend toward comprehensive, AI-driven approaches to sensitive information handling that combine multiple technologies and methodologies to address the complex challenges of modern data privacy and security requirements. 3 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline 1.5 Uniqueness and Innovation This project represents a significant advancement by integrating multiple cutting-edge technologies into a unified, production-ready serverless architecture. Unlike previous research focusing on individual components, our system provides a comprehensive end-to-end solution combining document classification, text extraction, PII detection, and anonymization within a single automated workflow. Key innovations include: •Leveraging AWS EventBridge for intelligent event-driven orchestration •Incorporating advanced security measures including GuardDuty malware protection and CloudTrail auditing •Implementing cloud-native approaches combining serverless computing with AI/ML applications •Integrating Amazon Textract, Comprehend, and custom anonymization techniques •Addressing the gap between academic research and practical deployment through a scalable, production-ready solution 2 System Architecture and Implementation Figure 1: System Architecture Overview 2.1 Frontend Component The frontend web application was implemented using JavaScript, HTML, and CSS, providing an intuitive user interface for document upload and progress tracking. The application was hosted in an Amazon S3 bucket and delivered globally through Amazon CloudFront CDN at the domain redpii.com. The frontend was secured using HTTPS with TLS certificates through AWS Certificate Manager (ACM). CloudFront integrated these certificates to ensure encrypted communication between clients and the application, protecting all data exchanged during document uploads, status retrieval, and downloads. Communication between the frontend and backend was facilitated through Amazon API Gateway, which served as the HTTP API middleware. API Gateway handled all GET and POST requests to ensure secure communication. Key frontend features included: 4 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline •Global content delivery through CloudFront CDN •Custom domain redpii.com (redact personally identifiable information) with HTTPS encryption •Real-time progress tracking and download management •Responsive design supporting multiple device types Backend communication features included: •CloudFront Custom Header Integration: AWS CloudFront was configured to add custom secret headers to incoming requests, enabling secure frontend–backend communication and fine-grained access control. These headers enforced security policies, supported request validation, and were forwarded to downstream services (such as API Gateway or Lambda) for authorization and processing. •API Gateway Request Handling: The web frontend interacted with AWS API Gateway using both GET and POST methods. GET requests were used to retrieve metadata, processing status, and anonymized documents. POST requests enabled file upload initialization and triggered document processing workflows. API Gateway enforced routing, input validation, and security rules while passing request payloads and headers to backend Lambda functions for business logic execution. 2.2 Processing Pipeline The document processing pipeline was orchestrated using AWS Step Functions, which coordinated multiple Lambda functions to classify, anonymize, and store documents. SQS queues interlinked with lambda for asynchronous invocationretries) and parallel processing. The workflow began with the ProcessDocument parallel state, followed by the invocation of the ClassifyDocument Lambda function. Upon successful classification, the pipeline executed the AnonymizePII step and subsequently stored the processed output using the StoreFinalDocument Lambda function. Each stage of the workflow included dedicated catch handlers to manage operational failures. Errors triggered corresponding Amazon SNS notifications such as ClassificationFailed, AnonymizationFailed, and StorageFailed. When all steps completed successfully, the pipeline published a final ProcessingComplete SNS message, marking the end of the workflow. 2.2.1 Orchestration Amazon EventBridge automatically triggers AWS Step Functions workflows upon S3 upload events. Step Functions orchestrate a multi-stage processing pipeline. 5 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline Figure 2: Processing Workflow 2.2.2 Document Classification The Classifier Lambda function provides the following capabilities: •Multi-format Input Support: Accepts PDF, TIFF, PNG, JPG, and TXT files. Automatically converts text files to PDF for unified processing. •Text Extraction: Utilizes Amazon Textract in both synchronous and asynchronous modes, depending on file type, to extract textual content and positional metadata. •Metadata and Audit: Records all processing steps, status changes, and document metadata in DynamoDB, supporting audit trails and real-time workflow tracking. •Integration: Handles event-driven invocations and integrates seamlessly with other AWS services in the pipeline architecture. •Error Handling: Includes fallback logic and exception management to ensure robust document processing and consistent output. 2.2.3 PII Anonymization The Anonymizer Lambda function implements automated anonymization of sensitive text using AWS Comprehend. Its main workflow includes: •Entity Detection: The function sends extracted document text to Amazon Comprehend to identify entities marked as Personally Identifiable Information (PII), such as names, email addresses, or ID numbers. For long documents, input text is truncated to comply with service limits. •Anonymization Logic: Detected PII entities are replaced systematically with typespecific placeholders (e.g., [NAME],[EMAIL]), by iterating from the end of the text to preserve correct offset positions and prevent overlap errors. 6 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline •Workflow Integration: Input and output status, along with PII detection results, are updated in DynamoDB for full auditability and to track processing steps within the pipeline. The anonymizer returns the document ID, anonymization status, the set of detected entities, the resulting anonymized text, and file type information to downstream applications. •Error Handling: Robust exception handling and logging ensure failures are captured and can optionally be recorded in DynamoDB. If no PII entities are found, the original text is returned unmodified. The anonymizer currently supports detection and redaction of the following PII types: •Names and personal identifiers •Social Security numbers •Email addresses and phone numbers •Medical and health information •Financial details and government IDs •Other PII types supported by Amazon Comprehend included 2.3 Storage Management Storage solutions comprise: •Raw and anonymized documents in segregated S3 prefixes for logical organization •Presigned URL Lambda functions generating secure, time-limited URLs for upload and download •Complete metadata, processing status, timestamps, and audit trails in Amazon DynamoDB •S3 and DynamoDB combination ensuring scalable, queryable persistence 2.3.1 Presigned URLs for Upload and Download To facilitate secure and efficient exchange of documents, Lambda functions are employed to generate presigned S3 URLs for both uploading and downloading files. This mechanism ensures that clients can interact directly with S3 using temporary, limited-access URLs—removing the need for permanent credentials and enforcing granular access control. •Secure File Upload: When a user initiates a document upload, the Lambda function validates the request, generates a unique document ID, and creates an S3 object key. It responds with a presigned URL for put object (upload), which allows the client to transfer the file directly to S3, with access expiring automatically (typically one hour). •Secure File Download: For document retrieval, a similar Lambda function generates a presigned URL for get object (download). This URL provides time-limited access to the requested file, allowing authorized users to securely download processed or anonymized documents without exposing public or persistent bucket permissions. •API and Security Integration: Both upload and download presigned URLs are returned via secure API responses, formatted for CORS compatibility and robust error handling. Logging and status codes provide transparency and reliability. 7 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline Figure 3: S3 Bucket Storing Anonymized Files 2.4 Security and Monitoring 2.4.1 Threat Detection •Amazon GuardDuty malware protection automatically scanning S3 uploads in real time •AWS WAF on CloudFront with OWASP Top 10 ruleset, SQL injection prevention, and DDoS mitigation 2.4.2 Access Control and Encryption •IAM role-based access control (RBAC) enforcing least-privilege permissions •End-to-end encryption in transit (TLS/SSL) and at rest (S3 server-side encryption, DynamoDB encryption) 2.4.3 Auditability and Compliance •AWS CloudTrail providing comprehensive logging of all API calls •S3 lifecycle policies and Immutable audit trail for regulatory compliance and forensic investigation 2.4.4 Operational Visibility •Amazon CloudWatch monitoring system performance and Lambda metrics •Amazon SNS delivering alerts for critical events and incidents 3 Results The system demonstrates successful document anonymization with the following characteristics: 3.1 Performance Metrics •PII Detection Accuracy: 95%+ entity recognition (confidence score) •Processing Time: 2–5 seconds for typical documents •Successful Anonymization: 100% of detected entities •System Availability: 99.9% uptime during testing •False Positives: Less than 1% 8 Shiva Sai Peddy AI-Powered Secure Document Anonymization Pipeline 3.2 Output Characteristics •Anonymized entities replaced with placeholders •Original document structure preserved •Clear audit trail of redactions maintained •Download-ready format provided Figure 4: Confidence Score from AWS Comprehend Figure 5: Input Document Provided to redpii.com Figure 6: Output Anonymized Document from redpii.com 9