Security & Compliance

Absolute anonymization is impossible. Pseudonymization and data masking are merely imperfect proxies that come at the cost of altering data utility and accepting residual risk of re-identification.

With Sarus, there is no need to try to "anonymize" datasets as they will never be accessed. Data consumers only retrieve statistical aggregates derived from them. To further strengthen protection, Sarus uses Differential Privacy to make re-identification from aggregates impossible (read more here).

The delineation between user-level data (sitting behind Sarus) and anonymous outputs is clear: only anonymous information can be retrieved with Sarus.

If each personal data processing is different, some principles are universal like using the highest standard of protection for all individuals. In some cases, the lawfulness of a processing depends directly on how much personal data has been protected.

For instance, when processing is necessary for purposes of the legitimate interest, you are taking on extra responsibility for considering and protecting people’s rights and freedoms.

Having a mathematical guarantee against re-identification risk is highly valuable.

Sarus by default embraces the mindset of zero-trust between data consumers and data owners.

Data consumers are granted the ability to query data but never to access it. They don't need to be trusted with access to the source database, which may be lost, compromised, or misused.

Privilege minimization finally applies to all data interactions.This default behavior can of course be relaxed for trusted users.