Sold by: Philterd
Deployed on AWS
Free Trial
Philter is a REST API that finds and redacts PII, PHI, and other sensitive information in text and PDFs. It runs on an EC2 instance in your own AWS account, so the data you process stays in your VPC. Policies decide what is found and whether each type is redacted, masked, encrypted, or pseudonymized, and an optional tamper-evident ledger records each redaction.
Overview
Philter is a REST API that finds and redacts PII, PHI, and other sensitive information in text and PDFs. It runs on an EC2 instance in your own AWS account, so the data you process stays inside your VPC: Philter processes it on that instance. Philter is open source under the Apache 2.0 license, so your security and compliance teams can review the code that handles your data.
Call Philter from your applications, data pipelines, and AI workflows. Send text and get back the redacted text, or submit a text-based PDF and retrieve the redacted copy when processing finishes. Generate a client in any language from Philter's OpenAPI specification, or use the Java SDK. Redact prompts before they reach a large language model, then restore encrypted values in the model's response.
Policies decide what to find and how to handle each type: redact, mask, keep the last four digits, hash, encrypt (including format-preserving encryption), or replace with a fake value of the same type. Consistent pseudonymization replaces the same value with the same stand-in across a document or a whole set of documents, so joins and relationships survive for analytics, testing, and AI training. Start from ready-made policies for common PII, financial PII, and healthcare PHI, and add your own types with custom dictionaries and patterns, such as medical record or account numbers.
Built-in detection covers persons' names (with a bundled NLP model), dates, ages, addresses, email addresses, phone numbers, SSNs, ITINs, EINs, Canadian SINs, credit card, bank routing, and IBAN numbers, passport and driver's license numbers, IP and MAC addresses, URLs, VINs, and US cities, counties, states, and zip codes.
Philter records evidence that compliance and legal teams can rely on. An optional tamper-evident, hash-chained ledger, turned on per context, records each redaction with the version of the policy that made it, legal holds keep that evidence from being deleted, and an audit log that can be exported to CSV records who changed what. Redacted output can be signed so its origin can be verified later, and encrypted values can be restored through a re-identification API that requires a stated reason and records every reversal.
Philter serves HTTPS and supports client certificates, API keys limited to the scopes each application needs, encryption of sensitive stored fields, webhooks, and Prometheus metrics. Each instance generates its own encryption key and first API key on first boot. Start with a single instance, then move to MongoDB with a shared Valkey cache to run several instances behind a load balancer.
Email support from the team that builds Philter is included with your subscription.
Redaction is configurable and probabilistic. Philter helps reduce the sensitive information in your documents and supports your HIPAA, GDPR, and other compliance efforts; validate its output against your own data.
Highlights
- Your data stays in your AWS account. Philter runs on an EC2 instance in your VPC and processes your text and PDFs on that instance.
- Policies decide what to find and how to handle it: redact, mask, hash, encrypt (including format-preserving encryption), or pseudonymize consistently so joins survive for analytics and AI training.
- Evidence for compliance and legal review: an optional tamper-evident ledger of each redaction with its policy version, legal holds, an exportable audit log, and signed output.
Details
Sold by
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu ubuntu-resolute-26.04-amd64-server-20260916
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 30 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covers your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
c7i.xlarge Recommended | $0.49 |
m5.xlarge | $0.49 |
t3.large | $0.49 |
m5.2xlarge | $0.98 |
t3.2xlarge | $0.98 |
c5.2xlarge | $0.98 |
c5.xlarge | $0.49 |
t3.xlarge | $0.49 |
m5.large | $0.49 |
m7i.xlarge | $0.49 |
Dimensions summary
You pay an hourly rate for the Philter software, billed per hour the virtual machine runs. The rate stays the same across every listed instance type, from t3 and m5 sizes to c5, c7i, m7i, and p3 options. Choosing an instance changes the compute power and the separate hardware cost charged by AWS, not the Philter software rate. Larger instances give more vCPU and memory for heavier redaction workloads. The software runs one instance per virtual machine. Your AWS account covers the underlying EC2 hardware alongside this hourly software charge.
Top-of-mind questions for buyers
Each listed instance type runs one Philter on a single virtual machine. You are billed for every hour that machine runs. The software recommends at least 2 vCPU and 8 GB of RAM, with 4 vCPU and 8 GB suggested for typical workloads. Smaller types suit testing.
The software charge meters running time only. A fully powered-off instance does not accrue the hourly Philter charge. Stopped or hibernated instances may still incur underlying AWS storage fees from your cloud account. The software license bills by the hour the virtual machine actually runs.
The hourly Philter software rate is the same across every listed instance type. A larger instance raises only the separate AWS hardware cost. Philter runs its models on CPU, so a GPU instance such as p3 adds cost without making redaction faster. Pick size based on vCPU and memory needs.
www.philterd.ai
Helpful?
Vendor refund policy
We do not currently offer refunds but you can cancel at any time.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Philter 4.0.1 is a security update to 4.0.0 with no behavior or API changes.
Additional details
Usage instructions
Philter 4.0 is used and administered through its REST API. On first boot, the instance generates its own encryption key and first API key and stores them in /opt/philter/.env, readable only by root. Connect to the instance over SSH as ubuntu and read them:
ssh -i <your-key.pem> ubuntu@<PUBLIC_IP> sudo cat /opt/philter/.envBack up PHILTER_ENCRYPTION_KEY and keep it the same for the life of the instance: Philter uses it to read the data it has encrypted. PHILTER_BOOTSTRAP_API_KEY is the first API key, with every scope.
Philter listens for HTTPS on port 8080 with a self-signed certificate (hence -k below). Replace it with your organization's certificate before production use. On the instance, check that Philter is up:
curl -sk <https://localhost:8080/api/health>From your own machine, send text for redaction with the built-in default policy, which redacts person names, SSNs, and email addresses:
export API_KEY=<PHILTER_BOOTSTRAP_API_KEY> curl -sk -X POST https://<PUBLIC_IP>:8080/api/filter \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: text/plain" \ --data-binary "George Washington was a patient and his SSN is 123-45-6789."The response is:
{{{REDACTED-name}}} was a patient and his SSN is {{{REDACTED-ssn}}}.The first request after Philter starts loads the person-name model and takes several seconds. Later requests are fast. To send a file, use --data-binary @file.txt.
For applications, create API keys that hold only the scopes they need, such as redact, with POST /api/api-keys. To retire the bootstrap key, create a replacement administrator key with every scope and revoke the bootstrap key with it. Restrict ports 22 and 8080 in the security group to your own CIDR ranges.
Getting started: https://philterd.ai/dev/start/aws/ Policies: https://philterd.github.io/philter/latest/policies/filter_policies.html
Resources
Vendor resources
Support
Vendor support
Email support from the team that builds Philter is included with your subscription. Email support@philterd.ai and allow up to 48 hours for a response. Documentation, quick starts, and the API reference are at https://philterd.github.io/philter/latest/ , and more resources are at
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By Philterd
By Cloud Storage Security
By Immuta
Top
10
In Masking/Tokenization, Text, Data Preparation
Top
10
In Data Governance, Storage, Security
Top
25
In Data Analysis
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Sensitive Data Detection and Redaction
Detects and redacts PII, PHI, and sensitive information including names (via bundled NLP model), dates, ages, addresses, email addresses, phone numbers, SSNs, ITINs, EINs, Canadian SINs, credit card numbers, bank routing numbers, IBAN numbers, passport and driver's license numbers, IP and MAC addresses, URLs, VINs, and US geographic identifiers.
Configurable Data Handling Policies
Policies determine handling methods for detected sensitive data including redaction, masking, encryption (with format-preserving encryption support), hashing, keeping last four digits, or replacement with fake values of the same type, with consistent pseudonymization across documents to preserve relationships for analytics and AI training.
Compliance and Audit Capabilities
Provides tamper-evident, hash-chained ledger recording each redaction with policy version, legal holds functionality, exportable audit logs tracking changes, signed output for origin verification, and re-identification API requiring stated reason with reversal recording.
Multi-Format Data Processing
Processes both plain text and text-based PDFs through REST API, with support for integration into applications, data pipelines, and AI workflows including LLM prompt redaction and response restoration.
Security and Infrastructure Features
Runs on EC2 instances within customer VPC ensuring data remains in AWS account, supports HTTPS with client certificates, API key authentication with scope limitations, encryption of sensitive stored fields, Prometheus metrics, MongoDB with Valkey cache for multi-instance deployment behind load balancer, and Apache 2.0 open source code for security review.
Sensitive Data Classification
Identifies hundreds of sensitive data types including PII, financial data, healthcare information, and government ID numbers across multiple file types and 11 regional localizations
Automated Scanning Architecture
Deploys using serverless architecture with AWS Fargate Container and AWS CloudFormation template, supporting real-time and on-demand DLP scanning at petabyte scale with no file size limit
Data Quarantine and Tagging
Automatically quarantines and tags files identified as sensitive or containing PII across all S3 buckets and EC2 EBS volumes
Multi-Channel Notifications and Integrations
Supports robust notifications and integrations with third-party ticketing systems, Slack, Microsoft Teams, Amazon Chime, SIEM solutions, Amazon SNS, AWS Security Hub, AWS CloudTrail, AWS Control Tower, and AWS Transfer Family
Bucket Configuration Assessment
Evaluates bucket attributes including public accessibility status and encryption configuration to assess data risk and identify exposure of sensitive data
Fine-Grained Data Access Control
Dynamic, fine-grained access control on AWS services including Amazon Redshift, Amazon S3, Amazon SageMaker, and Amazon EMR using de-identification, hashing, masking, and privacy enhancing technologies (PETs)
Sensitive Data Discovery and Classification
Automated sensitive data discovery capabilities to tag and classify sensitive data in AWS with highly accurate metadata generation for data security purposes
Attribute-Based Access Control
Attribute-based access control (ABAC) implementation to simplify and manage data security policies across multiple data sources
Policy Enforcement Engine
Plain language and as-code policy writing with consistent enforcement across all AWS data sources without requiring data copying, movement, or user-based access configuration
Data Activity Monitoring
Real-time continuous monitoring of data and user query behavior to track risky activity and enable proactive policy updates
Standard contract
No
No
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.