Obscura - PII detection and anonymization for Elixir

Hi everyone,

I’ve released Obscura 0.1.1, an Elixir library for detecting and anonymizing personally identifiable information before it reaches logs, external APIs, analytics systems, or LLM providers.

The dependency-light core recognizes structured identifiers such as email addresses, phone numbers, credit cards, SSNs, IBANs, IP addresses, URLs, and domains. Optional local Nx/Bumblebee profiles add person, location, and organization recognition without requiring a hosted recognition service.

A basic redaction looks like this:

{:ok, result} =
  Obscura.redact(
    "Contact jane@example.com or call 202-555-0188",
    profile: :fast,
    entities: [:email, :phone]
  )

result.text
#=> "Contact [EMAIL] or call [PHONE]"

Obscura also supports nested Elixir data:

input = %{
  customer: %{email: "jane@example.com"},
  password: "secret"
}

{:ok, result} =
  Obscura.redact(input,
    entities: [:email],
    field_policies: %{password: :drop}
  )

result.data
#=> %{customer: %{email: "[EMAIL]"}}

The available operators are replacement, redaction, masking, hashing, pseudonymization, and application-defined callbacks. Pseudonymization can use an ETS-backed vault when an application needs to restore selected values after an LLM or external-service round trip.

The three stable profiles serve different use cases:

• :fast uses dependency-light deterministic and parser-backed recognition.
• :balanced adds one local model for general person, location, and organization recognition.
• :accurate uses a two-model cascade for the highest measured general accuracy.

Model-backed profiles require explicit preparation and reusable runtime resources. Normal analysis never downloads a model implicitly.

One important asset note: :balanced and :accurate currently use an OntoNotes-trained TNER checkpoint. Obscura does not bundle or license that checkpoint, and LDC confirmed that commercial use requires LDC for-profit membership. The dependency-light :fast profile is unaffected. The complete review is documented in the model-asset licensing guide.

Links:

• Hex: obscura | Hex
• Documentation: obscura v0.1.1 — Documentation
• Example workbench: GitHub - hfiguera/obscura_examples: Phoenix LiveView workbench demonstrating Obscura's public PII detection and anonymization APIs · GitHub
• Practical guide: Protecting PII in Elixir Before It Reaches Logs, APIs, and LLMs · Obscura
• Model licensing: Third-Party Dependency And Model Asset Review — obscura v0.1.1

This is the first public release, and I’d particularly appreciate feedback about the API, entity coverage, structured-data behavior, model preparation, deployment, performance, and use cases that the current profiles do not handle well.