Privacy-Preserving AI Age Assurance
A production-oriented Azure landing zone for bring-your-own age-estimation models where the image is encrypted before upload, remains ciphertext through the public edge and gateway, is decrypted only inside isolated inference memory, and is never intentionally retained.
encrypts→Private
inference→Key Vault
+ attestation
Verify an age signal without turning the image into a platform asset.
The architecture treats the image as highly sensitive transient input rather than application data. The reusable artifact is the secure Azure execution boundary, not a particular model: customers can supply an approved model container while the platform keeps the network, identity, key-management, privacy, and operational controls consistent.
The core constraints are strict: no public origin exposure, no photograph persistence, encryption beyond TLS, passwordless Azure service access, fail-closed security behavior, minimal external disclosure, and an explicit separation between platform controls and model governance.
Reduce trust instead of extending it.
Plaintext exists only where inference requires it.
encrypts image
+ WAF
ciphertext only
decrypt + attest
The privacy invariant drives the rest of the design.
No image store is provisioned. Plaintext is constrained to client memory before encryption and inference-process memory during the request lifetime.
Application-layer envelope encryption keeps Front Door and the gateway outside the plaintext trust boundary, while Key Vault/HSM protects the long-lived RSA keys.
Short-lived shared nonce/session records in Managed Redis provide atomic one-time semantics across horizontally scaled gateway replicas.
Replica failures can be absorbed inside Container Apps, but loss of Key Vault, trusted session state, or the regional stateful stamp deliberately reduces availability rather than weakening controls.
Application Insights and Log Analytics retain operational metadata such as model version, latency, and status while request bodies and image-derived artifacts are excluded from logging.
The platform defines the secure execution contract but does not claim that a customer model is legally sufficient, unbiased, accurate at a statutory threshold, or appropriate for every jurisdiction.
Retention is minimized by architecture, not only by policy.
Stored nowhere. It exists for the request lifetime only and is used for inference inside memory.
Transport-only and nonpersistent. The design does not provision a blob store, queue, or database for verification imagery.
Fresh per request and nonpersistent. It exists only long enough to encrypt/decrypt the payload.
Lives in Key Vault / HSM across its managed key lifecycle and is used for unwrap/sign operations without being exported into application configuration.
Stored in Managed Redis with a short TTL—approximately two minutes—to provide atomic one-time anti-replay semantics across horizontally scaled replicas.
Model version, latency, and status can be retained for operations; image bodies, embeddings, tensors, exact-age outputs, and session keys are intentionally excluded from application logging.
Ephemeral state solves one problem without creating a user database.
Horizontal gateway replicas need shared atomic state to ensure that one-time sessions and nonces cannot be replayed across instances. Azure Managed Redis is used with TLS, Private Link, Entra authentication, access keys disabled, and TTL-only session/nonce records.
The tradeoff is explicit: Redis availability becomes part of verification availability. The baseline fails closed if that shared anti-replay state cannot be trusted.
Availability never outranks the security boundary.
unavailable
or sign result
fails closed
fallback
unavailable
cannot be trusted
fails closed
not assumed
stamp unavailable
unavailable
coordinated state
models + trust
Security and availability failures have deliberate outcomes.
Container Apps routes new requests to a healthy replica in the production parameter set.
Internal Container Apps routing allows a new request to reach a healthy inference replica; model readiness remains part of the decision path.
The service cannot unwrap the payload key or produce the required cryptographic result, so verification fails closed.
New one-time verification sessions fail closed unless an explicitly approved stateless mode is designed later.
The readiness probe fails and verification is denied or unavailable rather than routing blindly to an unhealthy model.
The current baseline is single-region for the stateful inference stamp. A second region requires a deliberate key, session-state, model-version, and attestation strategy rather than a copy/paste deployment.
Why failover is more than another Container Apps environment.
A second stamp needs an intentional regional Key Vault/public-key strategy so clients know which key version and trust path apply during failover.
One-time anti-replay state must remain deterministic across regions. A geo strategy cannot allow the same challenge to become valid twice.
Both regions must use synchronized approved model versions and an explicit trust model for signed decisions before Front Door origin failover can be treated as complete.
The privacy posture comes from what the platform refuses to own.
TLS protects transport links, but payload encryption keeps Front Door and the gateway outside the plaintext trust boundary. The consequence is that client code becomes part of the cryptographic protocol and needs interoperability/version testing.
The safest baseline retention policy is architectural omission: there is no image database, blob container, or queue intended to persist verification imagery.
Managed Redis holds opaque session/nonce state with short TTLs rather than creating a durable identity or image database.
The platform defines the execution contract and isolation boundary without claiming that an arbitrary model is fair, legally compliant, non-exfiltrating, or suitable for a jurisdiction.
Strong controls are documented separately from runtime proof.
Trust boundaries, crypto contracts, privacy rules, NFRs, ADRs, failure behavior, deployment design, and known limitations are source-controlled.
Foundation/workload Bicep and dev, test, and production parameter files compile cleanly.
The dev foundation completes live ARM What-If through GitHub OIDC. Managed Redis remains modeled but is omitted from dev cloud preflight because live B0/B1 capacity was unavailable.
Not claimed yet. No production model, privacy runtime tests, failover exercises, or end-to-end deployment evidence exist until the workloads are actually deployed.