Overview & Architecture

The ProofAML Screening Appliance is a self-hosted Docker image — proofaml/screening-appliance — that runs entirely inside your own VPC or network. It exposes the same name-screening engine that powers search on proofaml.com, packaged so a compliance or engineering team can run it without sending any query, subject, or match data outside their own infrastructure.

• Image: proofaml/screening-appliance:2026-08-02 (also tagged :latest)
• Port: 8400
• Persistent volume: /var/lib/proofaml
• Matcher: the same TypeScript matching engine used by this site's own /search and /screening — same normalization, fuzzy/phonetic matching, and nickname/transliteration handling.

Trust model

The appliance is designed so a subject's name never has to leave your network to be screened:

• Everything stays in your VPC. The container, the matcher, the API, and the persistent data volume all run on infrastructure you control. Search requests, batch files, and monitored-subject lists are never transmitted to ProofAML or any third party.
• The only outbound dependency is the updates endpoint. The appliance periodically fetches new sanctions/PEP/watchlist data from https://www.proofaml.com/updates/v1. That connection carries data into the appliance (a versioned manifest and delta files) — it never carries your query or subject data out. See Updates & synchronization.
• Even that egress is optional. Set OFFLINE=true and the appliance never calls the updates endpoint at all. Air-gapped deployments side-load updates into the volume manually — see Air-gapped / offline operation.
• Zero network access from first boot. The image ships with a baked-in data snapshot, so a freshly started container can answer searches immediately, before it has ever reached the network.

Architecture

                     Your VPC / network
   ┌───────────────────────────────────────────────────────┐
   │                                                        │
   │   your apps ──POST /v1/search──┐                       │
   │   your apps ──POST /v1/batch───┤                       │
   │   your apps ──/v1/monitor/*────┼──▶  Screening          │
   │   orchestrator ──GET /healthz──┘     Appliance          │
   │                                       (port 8400)       │
   │                                          │               │
   │                                          ▼               │
   │                              /var/lib/proofaml           │
   │                              (persistent volume:         │
   │                               data snapshot + deltas)    │
   │                                                        │
   └────────────────────────┬──────────────────────────────┘
                             │
                 outbound only, and only if OFFLINE≠true
                             ▼
              https://www.proofaml.com/updates/v1
              (versioned manifest + per-dataset deltas)

Nothing initiates a connection into your network. The single outbound path — appliance → updates/v1 — is a periodic pull the appliance makes on its own schedule (SYNC_INTERVAL); ProofAML never connects to your deployment.

What's inside the container

• The matcher. Name normalization, phonetic and fuzzy matching, DOB and country scoring, and identifier matching — the same engine behind this site's interactive screening tool.
• The data snapshot. A point-in-time export of every dataset selected by DATASETS (see Dataset selection & reference), stored on the persistent volume so it survives container restarts and upgrades.
• The API server. Search, batch, monitoring, status, and admin endpoints — see Search API reference, Batch screening, and Monitoring.
• The sync client. Fetches, verifies, and atomically applies data updates from UPDATE_URL on the configured interval — see Updates & synchronization.

Where to go next

• New deployment: Quickstart — docker pull → docker run → first search, in copy-pasteable commands.
• Choosing what to screen against: Dataset selection & reference.
• Wiring it into an application: Search API reference and Batch screening guide.
• Ongoing screening of a fixed subject list: Monitoring guide.
• All environment variables: Configuration reference.
• Something looks wrong: Troubleshooting / FAQ.

Not ready to self-host? The same underlying data and matcher are also available as a hosted API — see API for this data.