What are Satellites?
Formal Satellites are optional specialized containers you deploy alongside Connectors to enable advanced capabilities like PII detection, schema discovery, and custom policy data loading. Satellites extend Formal’s core functionality without adding complexity to the Connector itself. They’re deployed in your infrastructure and communicate with Connectors and the Control Plane.Satellite Types
AI
Detects PII and PHI and sensitive data in real-time for automatic redaction and
classification
Enables realt-time threat detection and mitigation for SSH and Kubernetes sessions
Data Discovery
Catalogs database schemas, tables, and columns across your data
infrastructure
Policy Data Loader
Loads external data into policies using custom code in Python or Node.js
AI Satellite
Identifies Personally Identifiable Information (PII) and Protected Health Information (PHI) in database responses, enabling automatic data masking and classification policies. Also enables real-time threat detection and mitigation for SSH and Kubernetes sessions.Features
- Real-time PII/PHI detection on query responses
- Threat detection and mitigation for SSH and Kubernetes sessions
- Automatic labeling of columns and fields with PII/PHI types
- Integration with policies for conditional masking
- GPU acceleration for high-throughput processing (optional, recommended for production)
Configuration
Required Environment Variables:FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token
--gpus all to enable GPU acceleration:
Data Discovery Satellite
Automatically discovers and catalogs your database schemas, tables, columns, and relationships.Features
- Scheduled schema discovery across all resources
- PII/PHI classification integration (requires AI Satellite)
- Schema change tracking with deletion policies
Configuration
Environment variables:FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication tokenDATA_CLASSIFIER_SATELLITE_URI: URI of AI Satellite (e.g.,localhost:50055)
Schema Discovery Jobs
Configure discovery schedules per resource:- Frequency: None, every 6/12/18/24 hours, or custom cron
- Deletion policy: Mark for deletion or auto-delete removed schemas
- Native user: Which credentials to use for discovery
Policy Data Loader Satellite
Enables custom code to load data from external sources into your policies, extending policy evaluation with dynamic business logic.Features
- Custom code execution in Python 3.11 or Node.js 18
- Scheduled runs with cron expressions
- External API calls to fetch data
- JSON output accessible in policies via
dataobject
Supported Runtimes
| Runtime | Identifier | Available Libraries |
|---|---|---|
| Python 3.11 | python3.11 | requests, httpx |
| Node.js 18 | nodejs18.x | lodash, axios |
Example: Load Zendesk Tickets for Contextual Data
This example fetches open Zendesk tickets and enriches them with user information for use in policies:Using in Policies
The Policy Data Loader outputs JSON data that becomes available in policies via thedata object. Here’s how to use the Zendesk tickets data in a policy:
- Filters database rows by checking if there are open Zendesk tickets for the email address
- Allows access with contextual ticket data when tickets exist
- Blocks access when no tickets are found for the email
Schedule Format
Policy Data Loaders use second-based cron expressions:| Expression | Description |
|---|---|
* * * * * * | Every second |
*/30 * * * * * | Every 30 seconds |
0 * * * * * | Every minute |
0 */5 * * * * | Every 5 minutes |
0 30 8 * * * | Daily at 8:30 AM |
second minute hour day month year
Configuration
Environment variables:FORMAL_CONTROL_PLANE_API_KEY: Satellite authentication token- Custom variables: Available to your code
The Satellite passes all its environment variables to worker processes, so you
can use environment variables in your code (e.g., API keys, endpoints).
Deployment
Satellites are Docker containers deployed in your infrastructure, similar to Connectors.Prerequisites
- Create the Satellite in the Formal console
- Copy the API token
- Deploy the container with appropriate environment variables
Recommended Deployment
- AWS ECS Fargate
- Kubernetes
- Docker
See the AWS Satellite deployment example for Terraform configuration.
Spaces and Satellites
Like Connectors and Resources, Satellites can be assigned to Spaces:- Satellite with a Space: Only communicates with Connectors and Resources in the same Space
- Satellite without a Space: Can communicate with any Connector or Resource
Managing Satellites
Creating a Satellite
1
Navigate to Satellites
Go to Satellites in the console
2
Select type
Choose AI Satellite, Data Discovery, or Policy Data Loader
3
Configure settings
- Name: Friendly identifier - Space: (Optional) Logical grouping
4
Copy API token
Save the token for deployment
5
Deploy container
Use the token in your deployment (ECS, Kubernetes, Docker)
Policy Data Loader Status
- Draft: Not running; code is being edited
- Active: Running and loading data on schedule