philterd/phield repository overview

⁠Phield

Phield is a PII drift and trend monitor. It receives counts of PII types found in your systems, learns what normal volume looks like for each source, and alerts when a count deviates from that trend, such as a sudden spike in credit card numbers moving through a billing service.

Phield receives counts, not content. It stores how many of each PII type were seen, never the values themselves.

Phield is open source (Apache 2.0) and part of the Philterd⁠ toolkit, alongside Philter⁠ for redaction and Phinder⁠ for discovery.

⁠Quick start

docker run -p 8443:8443 philterd/phield

Open the dashboard at https://localhost:8443/dashboard. The container generates its own self-signed certificate on start, so your browser and any client will warn about it until you supply a certificate of your own.

Send some counts:

curl -k -X POST https://localhost:8443/ingest \
     -H "Content-Type: application/json" \
     -d '{
           "source_id": "billing-app",
           "organization": "acme",
           "context": "production",
           "pii_types": {"credit-card": 42, "email": 118, "ssn": 3}
         }'

With no database configured, Phield keeps everything in memory and loses it on restart. The dashboard says so while that is the case.

⁠Links

• Documentation⁠
• Source⁠
• Philterd⁠
• Help and support⁠

Apache License 2.0. Copyright 2026 Philterd, LLC.