03 — Privacy
k-Anonymity is not a promise. It is a schema constraint.
A commitment that only exists in the documentation is not one. With Prometheus, the schema rejects — locally in the SDK and again at the mirror. Both gates are independent, and neither can be removed.
As of today: The local gate is implemented in all six SDKs and is tested against the K3 vectors. The second gate at the mirror is specified but not yet in operation — the mirror is being created in Phase 1. This page describes both because together they carry the commitment; where something is not yet running, it is noted.
Interactive
What happens when a cohort becomes too small.
k_effective is the number of distinguishable reporters behind an
aggregate. Pull the slider below five and see for yourself.
Cohort size
If k_effective falls below k_min, the aggregate
is neither discarded nor sent — it is locally rewritten into the collection
cohort __small_cohorts before it ever leaves the machine.
Colliding small rows are merged, k_effective is summed.
Default is k_min = 5. For modes B and C, which measure closer to the end user, k_min ≥ 25.
Defense in Depth
Fourteen stages, two independent PII gates.
Stages 1 to 8 run in the end user's process, stages 9 to 14 at the mirror. The two gates seem to duplicate each other — that is exactly the point.
Both gates must coexist
A diff that removes one of the two as an alleged duplication "cleanup" is an auto-FAIL in review. Removal is only possible via an explicit, documented architectural decision.
The mirror does not trust the SDK
Even a correctly signed submission is completely re-checked at the ingress — a manipulated SDK cannot get through this. Not yet in operation: The mirror is being created in Phase 1; until then, only the local gate of the two gates applies.
PII never on Disk
Raw events exist exclusively in RAM or tmpfs of the local aggregator. Only already signed aggregates are written to disk.
Banding instead of Plaintext
Numeric values from modes A, B, and C are never published as numbers,
but mapped to predefined bands — e.g., 30-60 instead of 47.
Blocklist
What the schema actively rejects.
Not a filter that quietly removes fields — a reject. If a submission contains any of these fields, it is not sanitized but rejected.
Shown are the thirteen K3 negative vectors against which every one of the six SDKs is tested today; the mirror checks them again at the ingress once it is in operation. The canonical blocklist is broader and also includes timestamps that resolve more finely than the measurement window. K3 and the k-Anon audit are hard stop criteria: no release passes the gate without them — not even a hotfix.
Verifiability
Verifiability over trust.
No one has to trust the operator of a mirror. Each accepted submission leaves a hash in a public log.
Public Audit Log
Each accepted submission should land as a hash in the Sigstore Rekor log — from day 1 of mirror operation, not as a later expansion stage.
Cross-Mirror Consistency
Once multiple mirrors carry the same aggregates, it can be verified from outside whether one of them deviates. In Phase 1, exactly one mirror runs — the check applies from the second one.
Snapshots are archived, not deleted
Once published, an open data snapshot remains. A correction gets a new date suffix and a log entry with the reason behind it.
ZK-Attestation from Phase 2
Planned: a ZK-SNARK proves compliance with k-anonymity without revealing the underlying numbers.