PII drift and trend monitoring
Phield receives PII type counts via an API or Kafka topic and alerts when a count deviates significantly from the established trend. Get notified through PagerDuty or Slack when there is a sudden spike in credit card numbers or an unexpected drop in redacted names.
Phield builds a baseline from the PII type counts it receives and flags when a new sample deviates significantly from the established trend. A sudden spike in credit card numbers or an unexpected drop in redacted names gets caught automatically.
Send PII type counts to Phield over its HTTP API or publish them to a Kafka topic. Either way, the payload shape is the same: a timestamped map of entity types to counts, tagged with a source and context.
Phield stores samples in a MongoDB time-series collection for durable, queryable history. When MongoDB is not available, it falls back to in-memory storage so you can still run it without external dependencies.
When a count deviates from the trend, Phield sends alerts to PagerDuty, Slack, or both. Your on-call team gets paged with the entity type, the observed count, the baseline, and the deviation.
Counts are tracked per source, per context, and per entity type. You can monitor multiple pipelines independently and see exactly which entity type drifted in which system.
Runs entirely inside your perimeter. No SaaS dashboard, no external data shipping. Your PII telemetry stays where you put it.
Phield receives PII type counts over HTTP or from a Kafka topic, stores them in a MongoDB time-series collection (or in memory), and runs the configured baseline detector against each new sample. Send the same payload shape either way.
Counts can be reported before or after redaction. The same Phield instance can compare both vantages of the same pipeline.
curl -X POST http://localhost:8080/ingest \
-H "Content-Type: application/json" \
-d '{
"timestamp": "2026-05-23T18:00:00Z",
"source_id": "patient-records-api",
"organization": "acme-health",
"context": "production",
"pii_types": {
"credit-card": 25,
"email": 110,
"ssn": 4,
"name": 60
}
}'
Install: pip install requests
import requests
from datetime import datetime, timezone
requests.post(
"http://localhost:8080/ingest",
json={
"timestamp": datetime.now(timezone.utc).isoformat(),
"source_id": "patient-records-api",
"organization": "acme-health",
"context": "production",
"pii_types": {
"credit-card": 25,
"email": 110,
"ssn": 4,
"name": 60,
},
},
)
package main
import (
"bytes"
"encoding/json"
"net/http"
"time"
)
func main() {
payload, _ := json.Marshal(map[string]interface{}{
"timestamp": time.Now().UTC().Format(time.RFC3339),
"source_id": "patient-records-api",
"organization": "acme-health",
"context": "production",
"pii_types": map[string]int{
"credit-card": 25,
"email": 110,
"ssn": 4,
"name": 60,
},
})
http.Post("http://localhost:8080/ingest", "application/json", bytes.NewReader(payload))
}
If something here isn’t covered, get in touch and we’ll answer.
Three ways to get going: deploy the open source yourself, spin it up from a cloud marketplace, or work with our team directly. Pick the path that fits.