drop aadhaar auth log (where lawfully available) · parse auth events · runs locally
aadhaar auth log · local only
heuristic screener · vendor schema varies · not definitive proof