Presidio PII Detection and Anonymization

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Presidio PII Detection and Anonymization - Ready-to-Use API

Presidio is an open-source data protection toolkit originally created at Microsoft and now community-governed under the Data Privacy Stack organisation. The upstream project has earned thousands of GitHub stars, reflecting broad adoption as a building block for privacy-aware data pipelines. This cloudimg AMI delivers Presidio as two cooperating HTTP services - fully installed, configured, and secured - so you can detect and anonymize personally identifiable information (PII) in free text within minutes of launch.

## What You Get

The image runs an analyzer that finds PII entities (names, email addresses, phone numbers, credit card numbers, and many more) returning their type, position, and confidence score, plus an anonymizer that redacts, replaces, masks, hashes, or encrypts those spans. Both services are reachable through a single authenticated API endpoint running entirely on the CPU with the spaCy en_core_web_lg NLP engine preinstalled - no GPU required, no manual model download, nothing to compile.

## Why This Image Instead of a DIY Install

• Skip complex setup: No need to create a Python environment, install presidio-analyzer and presidio-anonymizer, choose and verify an NLP model, write systemd units, or stand up an authenticating reverse proxy. This image handles all of that at launch.
• Secure by design: Upstream Presidio ships with no authentication, yet callers POST exactly the sensitive text they are protecting - making an open endpoint a data-exposure surface. This image binds both services to loopback and fronts them with nginx HTTP Basic auth on port 80.
• Hardened first boot: A one-shot service generates a fresh 24-character password per instance, proves the authentication gate and a real detection round trip, then marks the instance ready. No shared or default credentials ship in the image.
• No PII on disk: Access logging is disabled on the services and the proxy. The build verifies empirically that submitted text does not reach the system journal or any log file. Enable AWS EBS encryption at launch for encryption at rest.

## Security Architecture

The analyzer and anonymizer bind to loopback only. The single public surface is nginx on port 80 (basic auth) and SSH on port 22. Deploy in a private VPC subnet and use AWS security groups to restrict access. For TLS termination, place an Application Load Balancer or CloudFront distribution in front of the instance.

## Use Cases

• LLM and AI guardrails: De-identify prompts and documents before they reach a large language model or third-party API, keeping regulated data on your own infrastructure.
• Compliance and data governance: Redact PII from support tickets, chat logs, and exported datasets to meet GDPR, HIPAA, and internal data-residency requirements.
• Data engineering pipelines: Call the analyzer and anonymizer HTTP API from ETL jobs and data-preparation workflows to mask sensitive fields at scale before storage or sharing.

## How It Works

POST free text to /analyze to receive detected PII entities with their types and character offsets, then POST the text and those results to /anonymize to receive the redacted output. The image preserves Presidio's documented REST contract, so existing Presidio SDK clients work by simply pointing at the instance with the generated credentials. Only the unauthenticated /healthz probe is open for load-balancer health checks.

## Getting Started

1. Launch the AMI and open port 80 (HTTP) in your security group. Optionally open port 22 for SSH.

2. SSH into the instance and retrieve the generated credentials from /root/presidio-credentials.txt.

3. POST text to http:///analyze and http:///anonymize using HTTP Basic auth with username "admin" and the generated password.

You can test the full API workflow on a small instance to evaluate the product before scaling to production workloads.

## Evaluation Path

Launch the AMI on a small instance type to validate the API workflow, test entity detection accuracy against your data, and confirm integration with your pipeline - all before committing to a production deployment.

## Licensing and Provenance

The preinstalled NLP model is spaCy en_core_web_lg, an MIT-licensed artifact. Its licence is verified against the installed model at build time and recorded in a written provenance file that ships in the image, so the licensing position is documented rather than assumed.

Presidio and all product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.