03 — Privacy
k-Anonymity as a schema constraint
Here, k-anonymity is not a promise but a condition of the schema. A commitment that only exists in the documentation is not one. With Prometheus, the schema rejects — locally in the SDK and again at the mirror. Both gates are independent, and neither can be removed.
As of 2026-08-13: The local gate is implemented in all six SDKs and is tested against the K3 vectors. The second gate at the mirror has been built and tested since August — the mirror software rejects PII fields at the ingress and names the offending field when it does. For the first time, both gates carry. What is still missing is a publicly reachable mirror: the software so far runs only on the development environment.
Interactive
What happens when a cohort becomes too small
k_effective is the number of distinguishable reporters behind an
aggregate. Pull the slider below five and see for yourself.
Cohort size
If k_effective falls below k_min, the aggregate
is neither discarded nor sent — it is locally rewritten into the collection
cohort __small_cohorts before it ever leaves the machine.
Colliding small rows are merged, k_effective is summed.
Default is k_min = 5. For modes B and C, which measure closer to the end user, k_min ≥ 25.
Defense in Depth
The fourteen stages of the data flow
Two of the fourteen stages are independent PII gates. Stages 1 to 8 run in the end user's process, stages 9 to 14 at the mirror. The two gates seem to duplicate each other — that is exactly the point.
Both gates must coexist
A diff that removes one of the two as an alleged duplication "cleanup" is an auto-FAIL in review. Removal is only possible via an explicit, documented architectural decision.
Why the mirror checks again
Even a correctly signed submission is completely re-checked at the ingress — a manipulated SDK cannot get through this. The validation chain is built and running: signature, PII schema, k-anonymity, time window, duplicates. Not yet public: the mirror so far runs only on the development environment.
PII never on Disk
Raw events exist exclusively in RAM or tmpfs of the local aggregator. Only already signed aggregates are written to disk.
Banding instead of Plaintext
Numeric values from modes A, B, and C are never published as numbers,
but mapped to predefined bands — e.g., 30-60 instead of 47.
Blocklist
Fields the schema rejects
Not a filter that quietly removes fields — a reject. If a submission contains any of these fields, it is not sanitized but rejected.
Shown are the thirteen K3 negative vectors against which every one of the six SDKs is tested today; independently of that, the mirror checks the full blocklist at the ingress. The canonical list is broader than the thirteen vectors and also includes timestamps that resolve more finely than the measurement window. K3 and the k-Anon audit are hard stop criteria: no release passes the gate without them — not even a hotfix.
Verifiability
Verifiable from the outside
Verifiability takes the place of trust: no one has to trust the operator of a mirror. Each accepted submission leaves a hash in a public log.
Public Audit Log
Each accepted submission should land as a hash in the Sigstore Rekor log — from day 1 of mirror operation, not as a later expansion stage.
Cross-Mirror Consistency
Once multiple mirrors carry the same aggregates, it can be verified from outside whether one of them deviates. In Phase 1, exactly one mirror runs — the check applies from the second one.
Snapshots are archived, not deleted
Once published, an open data snapshot remains. A correction gets a new date suffix and a log entry with the reason behind it.
ZK-Attestation from Phase 2
Planned: a ZK-SNARK proves compliance with k-anonymity without revealing the underlying numbers.