Phield

Watch PII trends form

Phield ingests PII type counts from your redaction pipeline over an API or a Kafka topic, builds a per-type baseline from the stream, and flags a count that breaks from its trend.

Each type builds its own baseline from the incoming stream. When a count breaks from its trend, Phield alerts through PagerDuty or Slack.

Run it with Docker

Phield ships as a multi-arch image (x86-64 and arm64) on Docker Hub at philterd/phield. It keeps its history in a MongoDB time-series collection, so bring both up together with Compose.

# 1. Save this as docker-compose.yaml
services:
  mongodb:
    image: mongo:8.2.12
    volumes:
      - mongodb_data:/data/db
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 10s
      timeout: 5s
      retries: 5

  phield:
    image: philterd/phield:latest
    ports:
      - "8443:8443"
    environment:
      PHIELD_MONGO_URI: mongodb://mongodb:27017/phield
      PHIELD_TREND_METHOD: percentage_delta
      PHIELD_ALERT_THRESHOLD: "0.2"
      PHIELD_WINDOW_SIZE: "24"
    depends_on:
      mongodb:
        condition: service_healthy

volumes:
  mongodb_data:

# 2. Bring up Phield and MongoDB
docker compose up -d

# 3. Send a set of counts. The -k is there because the container
#    generates its own self-signed certificate when it starts.
curl -k -X POST https://localhost:8443/ingest \
  -H "Content-Type: application/json" \
  -d '{
    "source_id":    "patient-records-api",
    "organization": "acme-health",
    "context":      "production",
    "pii_types": { "credit-card": 25, "email": 110, "ssn": 4, "name": 60 }
  }'

# 4. Watch the trends build at https://localhost:8443/dashboard

The container serves HTTPS on port 8443 and generates a self-signed certificate at start, so browsers and clients warn about it until you mount a certificate of your own through PHIELD_CERT_FILE and PHIELD_KEY_FILE. Leave PHIELD_MONGO_URI unset and Phield falls back to in-memory storage, which is fine for a look around but loses its history on restart. Every setting is covered in the documentation.

Sending PII counts to Phield

Phield receives PII type counts over its HTTP API or from a Kafka topic, stores them in a MongoDB time-series collection (or in memory), and runs the configured baseline detector against each new sample. Send the same payload shape either way.

These examples post to a deployed Phield at https://phield.internal:8443/ingest. Against a container you just started locally, use https://localhost:8443/ingest and skip certificate verification while it is still on its generated self-signed certificate. Counts can be reported before or after redaction, and the same Phield instance can compare both vantages of the same pipeline.

curl -X POST https://phield.internal:8443/ingest \
  -H "Content-Type: application/json" \
  -d '{
    "timestamp":    "2026-05-23T18:00:00Z",
    "source_id":    "patient-records-api",
    "organization": "acme-health",
    "context":      "production",
    "pii_types": {
      "credit-card": 25,
      "email":       110,
      "ssn":         4,
      "name":        60
    }
  }'

import requests
from datetime import datetime, timezone

requests.post(
    "https://phield.internal:8443/ingest",
    json={
        "timestamp":    datetime.now(timezone.utc).isoformat(),
        "source_id":    "patient-records-api",
        "organization": "acme-health",
        "context":      "production",
        "pii_types": {
            "credit-card": 25,
            "email":       110,
            "ssn":         4,
            "name":        60,
        },
    },
)

package main

import (
    "bytes"
    "encoding/json"
    "net/http"
    "time"
)

func main() {
    payload, _ := json.Marshal(map[string]interface{}{
        "timestamp":    time.Now().UTC().Format(time.RFC3339),
        "source_id":    "patient-records-api",
        "organization": "acme-health",
        "context":      "production",
        "pii_types": map[string]int{
            "credit-card": 25,
            "email":       110,
            "ssn":         4,
            "name":        60,
        },
    })
    http.Post("https://phield.internal:8443/ingest", "application/json", bytes.NewReader(payload))
}