Problem: Companies need metrics, not profiles. Traditional analytics collect personally identifiable raw data and create legal risks and shadow data lakes.
Solution: Federated telemetry based on VDAF (Verifiable Distributed Aggregation Functions). End devices aggregate locally; only cryptographically split shares leave the device. Two independent aggregators compute metrics — without access to individual data.
What do you get?
- Privacy by default: No centralization of raw data, no re-identification; only verified aggregates.
- High data quality: Robust against outliers and manipulation (noise budget, outlier guards).
- Compliance-ready: Data minimization, purpose limitation, short retention — reporting metrics instead of raw events.
Reference architecture
- Client SDK: Captures only whitelisted signals (e.g., latency, feature usage, energy consumption), applies local filters, and splits values cryptographically.
- Dual aggregators: Separate operator identities; both are required to produce a result — single-party abuse excluded.
- Query gateway: Defines metrics (A/B KPIs, SLOs, distributions instead of raw values) and enforces min-k thresholds and time windows.
- Report layer: Dashboards deliver aggregations, confidence intervals, and data-quality scores.
Security & quality mechanisms
- k-anonymity thresholds, differential privacy, per-domain noise.
- Schema validators: Only permitted metrics, no free-text fields.
- Transparent governance: Records of processing, audit hooks, external review interface.
Use cases
- Apps & SaaS: Measure feature adoption without user tracking.
- IoT & device fleets: Energy profiles, failure rates, firmware effects.
- Smart spaces: Utilization and environmental data without personal references.
From zero to production
- 90-day program: Data inventory → metric catalog → SDK rollout → dual-aggregator setup → audit.
- Migration without disruption: Parallel run with existing telemetry, hard shutdown of raw-data sources after approval.
Outcome: Decision-makers get hard numbers — without personal shadow copies. Technology that enables measurement, not surveillance.