Absolute anonymization is impossible. Pseudonymization and data masking are merely imperfect proxies that come at the cost of altering data utility and accepting residual risk of re-identification.
With Sarus, there is no need to try to "anonymize" datasets as they will never be accessed. Data consumers only retrieve statistical aggregates derived from them. To further strengthen protection, Sarus uses Differential Privacy to make re-identification from aggregates impossible (read more here
The delineation between user-level data (sitting behind Sarus) and anonymous outputs is clear: only anonymous information can be retrieved with Sarus.