TrustGraph privacy guarantees

Four rules that keep identities and institutions hidden every time TrustGraph runs a query.

They make sure that nobody in the process, including the institutions taking part, learns more than they need to.

The four privacy guarantees that hold on every TrustGraph query are end-user de-identification, requestor de-identification, voucher de-identification, and no response disclosure. A query is one check of an identity against the network, and a voucher is a participating institution that contributes to the answer.

The four guarantees are:

• End-user de-identification. Identifiers are de-identified before they leave the institution's environment, and raw customer data never crosses the network.
• Requestor de-identification. No participant can tell which institution submitted the query.
• Voucher de-identification. The institution that asked cannot see which participants contributed to the answer.
• No response disclosure. A contributing institution learns nothing from the outcome of the query, including whether its own data matched.

The guarantees depend on a few technical choices:

1. Identifiers are de-identified before any joint computation begins.
2. The computation uses secure multi-party computation, so parties work on cryptographic shares and not on raw data.
3. Each query uses fresh, one-time cryptographic values, so the same identifier produces a different query every time and queries cannot be linked.

The guarantees are properties of the architecture. They follow from how the system is built, and they do not depend on a policy that someone could change.

The privacy guarantees sit next to terms that are easy to mix up:

• De-identification is the general practice, and end-user de-identification is the first guarantee.
• Secure multi-party computation is the cryptographic method that supports the guarantees.
• Data minimization limits how much data is collected, while the guarantees limit what is revealed in each query.