Philter on Azure: quick start

Philter on Azure Marketplace

Philter from Azure Marketplace runs on its own virtual machine in your Azure subscription, so the text you redact stays inside it. This page takes you from launch to your first redacted text, then to a key your application can use.

1. Launch Philter

1. Open Philter on Azure Marketplace and choose Get It Now, then Continue, signing in to Azure if asked.
2. Choose Create.
3. Fill in the virtual machine details. Standard_F4s_v2 is recommended, and smaller sizes are for testing. Choose SSH public key authentication and note the administrator username.
4. Choose Review + create, then Create.

The listing opens ports 22 (SSH) and 8080 (Philter’s API). Restrict both to your own address ranges.

2. Connect over SSH

ssh -i my-key.pem azureuser@<PUBLIC_IP>

Use the administrator username and key you chose when creating the virtual machine (azureuser is the portal’s default), and its public IP address from the virtual machine’s overview.

3. Get your API key

On its first boot the virtual machine generates its own keys into /opt/philter/.env, readable only by root:

sudo cat /opt/philter/.env

PHILTER_ENCRYPTION_KEY=...
PHILTER_BOOTSTRAP_API_KEY=sk_...

• PHILTER_BOOTSTRAP_API_KEY is the first API key. It belongs to the admin user and holds every scope.
• PHILTER_ENCRYPTION_KEY encrypts Philter’s data at rest. Back it up and do not change it: Philter’s data cannot be read without it.

Check that Philter is running:

curl -sk https://localhost:8080/api/health

{"status":"UP","applicationVersion":"4.0.0","redactionPolicySchemaVersion":"1.3.0","gitCommit":"e9a6bc0"}

4. Redact some text

From your own machine, replacing <PUBLIC_IP> with the virtual machine’s public IP address:

export PHILTER_API_KEY="sk_..."

curl -sk "https://<PUBLIC_IP>:8080/api/filter" \
  -H "Authorization: Bearer $PHILTER_API_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary "George Washington was a patient and his SSN is 123-45-6789."

{{{REDACTED-name}}} was a patient and his SSN is {{{REDACTED-ssn}}}.

The built-in default policy redacts person names, SSNs, and email addresses. The first request after Philter starts loads the person-name model, so it takes several seconds, and longer on a newly launched virtual machine. Later requests are fast.

Philter serves HTTPS with a self-signed certificate, hence -k.

5. Create a key for your application

Give each application its own key holding only the redact scope, rather than the admin key:

curl -sk "https://<PUBLIC_IP>:8080/api/api-keys" \
  -H "Authorization: Bearer $PHILTER_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"scopes": ["redact"]}'

{"id":"...","username":"admin","apiKey":"sk_...","scopes":["redact"]}

The key is shown once: Philter stores only its hash. A redact key can call /api/filter and /api/explain and nothing else. See scopes.

Before production

• Replace the self-signed certificate with your own. See TLS.
• Philter keeps its policies, ledger, and audit log in SQLite on the virtual machine’s disk. Back up the disk, and keep PHILTER_ENCRYPTION_KEY with the backups. See SQLite storage.
• One virtual machine runs one Philter. To run several behind a load balancer, see High Availability.
• Philter needs no outbound internet access to redact. The default policy’s model ships with it, and it connects out only to services you configure, such as a remote PhEye service, webhooks, or Phield. Once the virtual machine is running, you can move it to a subnet with no internet egress; updates then come through your own mirror.
• Write policies for your own data. See redaction policies.
• A virtual machine launched from a marketplace may not be ready for a HIPAA environment as launched. Check your organization’s requirements with your compliance officer.

Detection is probabilistic. Validate Philter’s output against your own data before relying on it.

Help

The Philter documentation is the full reference. Ask questions in the Philterd Slack, see support options, or work with us on your deployment through consulting.