Pre-launch / design system · Architecture and control statements are design targets requiring independent verification before deployment.
BINGBONG · ARCHITECTURE · DESIGN TARGET

Planned topology, end to end.

The privacy boundary is a designed artifact. Identity and event data are kept in separate domains. The buyer receives cohort-shaped output only. Reidentification and singling-out remain residual risks and are managed, not eliminated.

BingBong planned topology Participating surfaces ingest events under opaque tokens; the privacy boundary separates identity and event domains; cohort construction happens behind the boundary; the buyer receives cohort-shaped output. PARTICIPATING SURFACES PRIVACY BOUNDARY BUYER DOMAIN CONSUMER RIGHTS SURFACE GOVERNANCE FUNCTION AUDIT & DISCLOSURE Surface A · publisher.example token request · consent receipt Surface B · app.example edge filter · first-party Surface C · partner.example provenance metadata Identity domain token issuance · revocation · consent rotation policy · key separation access logging · least privilege Event domain event ingest · aggregation · cohort build k-threshold · query budget · suppression no direct identifiers in this domain provenance · retention metadata Cohort contract buyer.example · v0.1 aggregates only provenance · retention_until Prohibited-uses list no per-user lookups no cross-graph linking no sensitive-class inference contract enforcement token events cohort output audit feed Consumer rights opt-out · access · delete · correct GPC suppression target Governance function claims register · threat model · abuse path independent review · documented outcome Audit & disclosure access logs · ratio tests documented cadence · language boundary events review / sign-off
Participating surfaces ingest events under opaque tokens; the privacy boundary separates identity and event domains; cohort construction happens behind the boundary; the buyer receives cohort-shaped output only. Consumer rights surface, governance function, and audit & disclosure are external to the boundary and connect via documented boundary events.
INGRESS

Token-gated

Inputs enter via opaque tokens issued by a documented surface. Identity-bound fields are filtered at the edge or routed to a separate identity domain.

INTERIOR

Separated domains

Identity and event data do not co-reside. Cross-domain joins are a privileged operation, logged and budgeted.

EGRESS

Cohort-shaped

Outbound contracts emit aggregates with provenance, retention, and revocation metadata. Raw events and per-user rows do not exit.

CONTROL

Minimum-count thresholds

Cohorts below the minimum count are suppressed at the boundary. Sizes are rounded to defeat near-singling-out.

RESIDUAL

Reidentification & singling-out

Residual risks are named, not hidden. Mitigations are documented in the threat model and reviewed on a quarterly cadence.

REVOCATION

Boundary event

Revocation propagates to ingestion and cohort construction within the documented window. Revoked tokens are not silently reactivated.

BingBong · architecture · design target · self-contained noindex,nofollow