Quick Start Guide

This guide gives an overview of the Enprivacy 3.0 platform: what it does, how it is architected, how its services communicate, and the deployment models available to you. It reflects the Enprivacy 3.0 Quick Start Guide (Version 6) and is intended for teams evaluating or preparing to deploy the platform.

Download the PDF (Version 6)

Executive Summary

Guided by the philosophy that every piece of data is a piece of someone’s life story, Enprivacy develops solutions that bring a privacy-first design to data categorisation, redaction, and analysis, as well as right-sized governance for confidential data.

The Enprivacy 3.0 platform brings together Enprivacy’s decades of experience in customer trust building, confidential data management, and data breach crisis resolution to offer a unique and unified platform for applying privacy-focused data analytics to your most sensitive information — your customer and strategic documents and data. It provides a control tower for managing your confidential data according to the policies and procedures you define.

The platform is designed for ease of deployment in multiple environments, including on-premises platforms as well as cloud providers. The deployment model itself is purposefully simple, with ready-to-deploy Open Container Initiative (OCI) images available, or replaced with cloud service provider offerings as needed.

Use Cases

Enprivacy 3.0 has been proven for the common use cases below; nonetheless, the platform is highly extensible and many new use cases are supported over time. These use cases include but are not limited to:

• Retrieval Augmented Generation (“RAG”) with Generative Artificial Intelligence (“AI” or “Gen AI”) solutions without sharing confidential information,
• Machine Learning (“ML”) using anonymised data,
• data science and statistical analysis of redacted data,
• internal training using pseudo-anonymised data,
• sharing of redacted documents to third parties, and
• other advanced use cases.

Enprivacy 3.0 Features

Enprivacy 3.0 unlocks immediate value from your confidential data for use in a variety of use cases, while simultaneously simplifying compliance with privacy regulations such as (but not limited to) the Singapore Personal Data Protection Act (“PDPA”), the European Union (“EU”) General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), the Australian Privacy Principles (“APP”), and other regional and industry-specific rules.

The platform allows non-technical end-users to upload files, run automated detection, review proposed redactions, and export compliant versions while maintaining a full audit trail.

Additionally, administrative users may add document repositories for automated monitoring, such as (but not limited to) Gmail inboxes, Simple Storage Service (S3)-compatible services, Microsoft Azure blob storage, network file shares, Microsoft OneDrive drives and SharePoint sites, NetDocuments repositories, and others. These document repositories may be periodically scanned for PII and CII, with the option to generate redacted or anonymised documents automatically.

The platform utilises a proprietary combination of optical character recognition (“OCR”), pattern matching, Named Entity Recognition (“NER”), ML techniques, and other capabilities to generate insights into the confidential data held by structured, semi-structured, and unstructured data sets. Underpinning the analysis is a graph or network topology which supports rapid factual and inferred analysis of the confidential data.

The features of Enprivacy 3.0 may be described under three headings: Manage, Monitor, and Explore.

Manage

Administrative users may configure the general settings of the platform, including segregation of data into workspaces, identified categories, categorisation rule sets, and redaction plans. Furthermore, administrative users may define databases and document repositories, as well as set secure credentials.

Monitor

Designated users may view reports and analytics of activities.

In future, this will include capabilities to write, publish, and link internal policies, procedures, controls, and evidence to external law and regulations, helping compliance and legal teams manage their confidential data effectively.

Explore

Designated users may access many tools designed to explore the data processed:

• Graph Explorer — explore the relationships between data, documents, repositories, databases, and more.
• Documents Explorer — read redacted versions of documents, and upload documents for analysis.
• Database Explorer — explore database structures.
• Chat — ‘talk’ to your data, both anonymised and original, as needed.
• Search — perform general queries across your data.

Overall Architecture

The Enprivacy 3.0 solution is composed of five services, one database, and one blob (file) storage.

                                  ┌──────────────────────┐
        Internet / Intranet       │   Auth Services      │
                 │                │   (via API)          │
                 ▼                └──────────┬───────────┘
        ┌─────────────────┐                  │
        │ Web App Firewall│◄─────────────────┘
        └────────┬────────┘
                 ▼
        ┌─────────────────┐
        │  Load Balancer  │
        └────────┬────────┘
        ┌────────┴────────────┐
        ▼                     ▼
  ┌─────────────┐     ┌────────────────┐
  │ App Service │     │ Batch / Job    │
  │             │     │ Service        │
  └──────┬──────┘     └────────┬───────┘
         └──────────┬──────────┘
     ┌──────────┬───┴───────┬────────────┬───────────────┬───────────────┐
     ▼          ▼           ▼            ▼               ▼               ▼ (GPU)
┌────────┐ ┌────────┐ ┌──────────┐ ┌───────────┐ ┌──────────────┐ ┌─────────────┐
│Postgre │ │File /  │ │  OCR     │ │Inference  │ │External svcs/│ │LLM Service  │
│  SQL   │ │  blob  │ │Service   │ │Adapter    │ │storage/other │ │             │
└────────┘ └────────┘ └──────────┘ └───────────┘ └──────────────┘ └─────────────┘

Baseline configuration

This architecture represents a baseline configuration of Enprivacy 3.0 for a Proof of Value (PoV) demonstration. During the PoV, performance and costs are monitored, with a right-sizing activity planned at project end.

Services

All services are offered as OCI or Docker container images.

Web service

Serves the end-user and administrative interfaces. This service also includes the public interfaces for the Job service.

• Supports horizontal scaling.
• Stateless — all state is held within the database or the blob storage.

Component	Minimum	Recommended
Count	1	1
CPU	1 core	2 cores
RAM	2 GB	4 GB
Disk	20 GB	20 GB
GPU	Nil	Nil

It loads no machine-learning models: those run in the Inference Adapter. The address data set is baked into the image — see Model data.

Job service

Processes background jobs and tasks. This service has no public interface.

• Supports horizontal scaling.
• Stateless — all state is held within the database or the blob storage.

Component	Minimum	Recommended
Count	1	1
CPU	1 core	2 cores
RAM	2 GB	4 GB
Disk	20 GB	20 GB
GPU	Nil	Nil

It loads no machine-learning models: those run in the Inference Adapter. The address data set is baked into the image — see Model data.

Inference Adapter service

Runs the platform’s local machine-learning models — document embedding, search reranking and named-entity detection — for the Web and Job services. Mandatory: they do not start without it. The models are baked into the image, so nothing is downloaded at runtime. It listens only over TLS and requires an API key; see Inference Adapter.

Component	Minimum	Recommended
Count	1	1
CPU	4 cores	4 cores
RAM	8 GB	8 GB
Disk	20 GB	20 GB
GPU	Nil	Nil

These are the tested reference figures; the service sizes its own thread pools from the CPU limit it is given.

LLM service

Runs the system Large Language Model the platform’s agents use for detection and classification, via vLLM and an open-source model validated for use with Enprivacy 3.0. Encoder models — embedding, reranking, entity detection — run in the Inference Adapter instead. Generally, Enprivacy 3.0 needs one instance only.

The service is stateless; however, models are cached to local storage for performance. Enprivacy recommends attaching durable storage for this purpose.

Component	Minimum	Recommended
Count	1	1
CPU	4 cores	8 cores
RAM	32 GB	58 GB
Disk	200 GB	200 GB
GPU	T4-equivalent	T4-equivalent

GPUs can be expensive

Because GPUs can be costly, the Enprivacy platform can be used with hosted service tools such as OpenAI’s ChatGPT, AWS Bedrock, Azure OpenAI, Google Vertex, and others. The URLs to be allow-listed depend on the service used — Enprivacy can work with your security teams to select and implement such hosted tools.

Text Extraction (OCR) service

Provides optical character recognition (OCR) of documents using a configured Docling open-source tool. The service is stateless.

Component	Minimum	Recommended
Count	1	1
CPU	1 core	2 cores
RAM	2 GB	4 GB
Disk	20 GB	20 GB
GPU	Nil	Nil

Network allow-listing

The Enprivacy 3.0 platform uses an external authentication and authorisation platform for user access control. The following endpoint must be reachable from the Web, Job, and LLM services:

• auth.enprivacy.com

A self-hosted LLM service fetches models on first use from the Hugging Face Hub. The Web, Job and Inference Adapter services download nothing. At the time of writing, the download Content Distribution Network URLs are:

• huggingface.co
• cdn-lfs.huggingface.co
• cdn-lfs-us-1.hf.co
• cdn-lfs-eu-1.hf.co
• cdn-lfs.hf.co
• cas-bridge.xethub.hf.co

Alternatively, the desired images can be loaded into a service’s durable storage as a one-off action.

Database

An always-on PostgreSQL database is critical for the platform, as it holds state for the Web and Job services. It also requires certain extensions to support the vector and graph queries that are key to the platform. Enprivacy recommends following any corporate standards for database security.

Component	Minimum	Recommended
Engine	PostgreSQL	PostgreSQL
Version	16+	18+
Count	1	1
CPU	2 cores	4 cores
RAM	4 GB	8 GB
Disk	100 GB	200 GB
Connections	50	100

First set-up

A database schema should be created, along with a user with a password and all privileges over that schema. This user is used by the service to prepare the schema on first run and to apply schema updates during version upgrades, as well as for all day-to-day activities. For improved security, it is recommended to perform password rotations in either a single-user or dual-user configuration.

Extensions

The PostgreSQL database must include the following extensions:

• hstore
• pgvector

Blob storage

Blob (file) storage is needed for holding document uploads as well as redacted documents. This generally grows over time as documents are uploaded or redacted, but there is no minimum size required.

Component	Minimum	Recommended
Storage	10 GB	10+ GB

Communications

Interservice communications

Services communicate with each other over the following default ports.

From	To	Port	Protocol
Internet	Web	8080	HTTP
Web	Database	5432	TCP
Job	Database	5432	TCP
Web	LLM	8000	HTTP
Job	LLM	8000	HTTP
Web	OCR	5001	HTTP
Job	OCR	5001	HTTP
Web	Inference Adapter	8443	HTTPS
Job	Inference Adapter	8443	HTTPS

Public communication

Only the Web service needs to be exposed for administrative and end-user access. Enprivacy recommends using HTTPS termination via load balancers or other tools as appropriate for your environment; this requires providing your own certificates for your selected domains.

Alternatively, Enprivacy 3.0 can be configured for HTTPS with certificates provisioned by Let’s Encrypt. Enprivacy can work with your team to select and implement an appropriate approach.

Deployment Models

Recommended deployment model with containers

Enprivacy recommends deploying the platform to cloud-based service providers such as AWS, Azure, Google, or Huawei, to make use of the managed-service capabilities these platforms offer.

Enprivacy 3.0 is designed for ease of deployment to many environments and, as such, has adopted Open Container Initiative (OCI) or Docker containers. Enprivacy can provide the needed container images via the GitHub Container Registry, or by pushing images to your own container repository.

• Each service can be deployed using the cloud provider’s ‘container application’ service, or via Kubernetes.
• The database can be deployed using the cloud provider’s managed PostgreSQL service, or through an assembled container with all needed extensions.
• The blob storage can likewise be deployed using the cloud provider’s managed blob storage service, or through an open-source S3-compatible container (e.g. MinIO or Garage).

Alternative options for LLMs

The cost of GPUs can be significant. Enprivacy can, in many cases, work with your selected LLM providers to re-use existing commitments for platforms such as AWS Bedrock, Azure OpenAI, or Google Vertex.

Compliance with client requirements

The architecture is designed for flexibility. Enprivacy will work with your teams to identify and implement any changes needed for compliance or regulatory purposes.

All-In-One

For demonstration purposes, it is possible to operate the Web, Job, OCR, Inference Adapter and Database services in a single environment, with durable storage on a local disk. The LLM service is not included in this design; an external LLM service should be used. Enprivacy can provide a single Docker Compose file to enable this environment.

Not for production

Enprivacy does not recommend the All-In-One deployment model for production usage. The Web, Job, and OCR services exhibit ad hoc resource utilisation, so resource contention is possible in such configurations.

The table below provides the minimum and recommended computing configuration with and without the OCR service. Add 4 cores and 8 GB of RAM to either column for the Inference Adapter. The OCR service is required if demonstrating the content analysis and redaction features of Enprivacy 3.0.

Component	AIO without OCR	AIO with OCR
Count	1	1
Operating system	Linux (Ubuntu 22.04+ or Debian 12), 64-bit	Linux (Ubuntu 22.04+ or Debian 12), 64-bit
Docker	Docker Engine 24+ with Compose v2	Docker Engine 24+ with Compose v2
CPU	4 cores	8 cores
RAM	8 GB	16 GB
Disk	150 GB	200 GB