What are Satellites?
Formal Satellites are optional specialized containers you deploy alongside Connectors to enable advanced capabilities like PII detection, schema discovery, and custom policy data loading. Satellites extend Formal’s core functionality without adding complexity to the Connector itself. They’re deployed in your infrastructure and communicate with Connectors and the Control Plane.Satellite Types
AI
Detects PII and PHI and sensitive data in real-time for automatic redaction and
classification.
Enables real-time threat detection and mitigation for SSH and Kubernetes sessions
Data Discovery
Catalogs database schemas, tables, and columns across your data
infrastructure
Policy Data Loader
Loads external data into policies using custom code in Python or Node.js
AI Satellite
Identifies Personally Identifiable Information (PII) and Protected Health Information (PHI) in database responses, enabling automatic data masking and classification policies. Also enables real-time threat detection and mitigation for SSH and Kubernetes sessions.Features
- Real-time PII/PHI detection on query responses
- Threat detection and mitigation for SSH and Kubernetes sessions
- Automatic labeling of columns and fields with PII/PHI types
- Integration with policies for conditional masking
- GPU acceleration for high-throughput processing (optional, recommended for production)
Configuration
Required Environment Variables:FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token
--gpus all to enable GPU acceleration:
Data Discovery Satellite
Automatically discovers and catalogs your database schemas, tables, columns, and relationships.Features
- Scheduled schema discovery across all resources
- Regex-based column classification from inventory path (no AI backend)
- Prompt-based column classification via a linked AI Satellite or AWS Bedrock
- Schema change tracking with deletion policies
Prompt Classification Backends
Prompt labels need an LLM backend. You do not need an AI Satellite if you use AWS Bedrock. Regex labels never need either option. When prompt labels are configured, discovery samples row values from each table and sends column metadata to the classifier. The classifier returns labels based on your prompt definitions.- AWS Bedrock
- AI Satellite
The Data Discovery Satellite can call AWS Bedrock directly. No AI Satellite deployment or satellite link is required.Prerequisites:On ECS or EKS, attach an IAM role with
- AWS credentials available to the Data Discovery Satellite container (for example, an ECS task role or EKS service account)
- Amazon Bedrock access to the Claude Haiku inference profile in your AWS account and region
FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication tokenDATA_DISCOVERY_LABELING_USE_BEDROCK: Set totrueto use AWS Bedrock for prompt label classification instead of a linked AI Satellite
DATA_DISCOVERY_LABELING_USE_BEDROCK=true, discovery bypasses satellite link lookup and calls Bedrock with the default AWS credential chain. The value must be the string true; any other value falls back to the linked AI Satellite.bedrock:InvokeModel (or equivalent) for the inference profile in your account.Regex labels classify columns from inventory path alone and need no AI backend. Prompt labels need either AWS Bedrock or a linked AI Satellite. You do not need both.
Configuration
Environment variables:FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication tokenDATA_DISCOVERY_LABELING_USE_BEDROCK: Set totrueto classify prompt labels with AWS Bedrock instead of a linked AI Satellite (optional)
Schema Discovery Jobs
Configure discovery schedules per resource:- Frequency: None, every 6/12/18/24 hours, or custom cron
- Deletion policy: Mark for deletion or auto-delete removed schemas
- Native user: Which credentials to use for discovery
Policy Data Loader Satellite
Enables custom code to load data from external sources into your policies, extending policy evaluation with dynamic business logic.Features
- Custom code execution in Python 3.11 or Node.js 18
- Scheduled runs with cron expressions
- External API and database calls to fetch data
- JSON output accessible in policies via
dataobject
Supported Runtimes
Example: Load Zendesk Tickets for Contextual Data
This example fetches open Zendesk tickets and enriches them with user information for use in policies:Using in Policies
The Policy Data Loader outputs JSON data that becomes available in policies via thedata object. Here’s how to use the Zendesk tickets data in a policy:
- Filters database rows by checking if there are open Zendesk tickets for the email address
- Allows access with contextual ticket data when tickets exist
- Blocks access when no tickets are found for the email
Schedule Format
Policy Data Loaders use second-based cron expressions:
Format:
second minute hour day month year
Configuration
Environment variables:FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token- Custom variables: Available to your code
The Satellite passes all its environment variables to worker processes, so you
can use environment variables in your code (e.g., API keys, endpoints).
Deployment
Satellites are Docker containers deployed in your infrastructure, similar to Connectors.Container Image Registries
You can pull satellite images from either AWS ECR or GCP Artifact Registry:Prerequisites
- Create the Satellite in the Formal console
- Copy the API token
- Deploy the container with appropriate environment variables
Recommended Deployment
- AWS ECS Fargate
- Kubernetes
- Docker
See the AWS Satellite deployment example for Terraform configuration.
Spaces and Satellites
Like Connectors and Resources, Satellites can be assigned to Spaces:- Satellite with a Space: Only communicates with Connectors and Resources in the same Space
- Satellite without a Space: Can communicate with any Connector or Resource
Managing Satellites
Creating a Satellite
1
Navigate to Satellites
Go to Satellites in the console
2
Create Satellite
Click Create Satellite
3
Configure settings
- Name: Friendly identifier
- Satellite Type: AI, Data Discovery, or Policy Data Loader
- Space: (Optional) Logical grouping
4
Copy API token
Save the token for deployment
5
Deploy container
Use the token in your deployment (ECS, Kubernetes, Docker)
Policy Data Loader Status
- Draft: Not running; code is being edited
- Active: Running and loading data on schedule
Next Steps
Deploy a Satellite
Run Satellites in your infrastructure
Use in Policies
Reference Satellite data in policy rules
Configure Spaces
Segment Satellite access
View Logs
Monitor Satellite activity in logs