Pseudonymous architecture, in detail.
A serious privacy broker distinguishes between anonymization, pseudonymization, hashing, encryption, and tokenization. BingBong's design uses pseudonymization through tokenization. The differences are not cosmetic.
Five terms, five meanings.
| Term | What it does | Reversibility | What BingBong does |
|---|---|---|---|
| Anonymization | Removes identifiers so reidentification is effectively impossible. | Irreversible by design. The data is no longer about a person. | Not claimed. BingBong issues pseudonyms, not anonymized data. |
| Pseudonymization | Replaces identifiers with a token that still allows linkage within a controlled system. | Reversible inside the system, opaque outside it. | The design target. Token issuance is the pseudonymization step. |
| Hashing | Deterministic one-way transform. Same input → same output. Useful for join keys, not for identification. | Irreversible in practice if the hash is strong and salted. | Used internally where deterministic linkage is needed; never used as a public-facing token. |
| Encryption | Reversible transformation gated by a key. Used to protect data at rest and in transit. | Reversible by holder of the key. | Used at rest and in transit. Not a privacy primitive on its own. |
| Tokenization | Replaces a sensitive value with a non-sensitive surrogate. The mapping can be reversible, randomized, or cryptographic. | Depends on the mapping. | The mechanism used to implement pseudonymization. Mapping is randomized and rotated. |
How a token is produced.
The issuance step is the only place where identity and event data are at risk of co-residing. It is the most privileged operation in the system.
Request
A participating surface presents a request: a documented surface identifier, a key identifier, a consent receipt reference.
Randomize
BingBong draws from a cryptographically strong source and produces a randomized opaque token. There is no structural relationship to the requesting surface or any identifier.
Scope
The token is bound to the requesting surface and to a key identifier. Cross-surface continuity requires an explicit continuity event in the contract.
Return
The token is returned with key identifier, rotation policy, and provenance metadata. The mapping is held in the identity domain and is not exported.
How a cohort is constructed.
The aggregation step is where privacy and utility collide. The minimum-count threshold and the suppression policy are the engineering expression of that collision.
- Cohorts are defined by documented predicates over the event domain.
- Cohorts below the minimum-count threshold are suppressed at the boundary.
- Cohort sizes are rounded to the threshold to defeat near-singling-out by side-channel.
- Query budgets throttle expensive operations.
- Cohort outputs carry provenance, retention, and revocation metadata.
What can still go wrong.
Pseudonymization does not eliminate reidentification risk. It manages it. The honest list of residual risks is part of the operator's commitment under audit.
- Reidentification by join with an external dataset that shares feature space.
- Singling-out of a small cohort by repeated queries with side information.
- Cross-context correlation across participating surfaces via shared features.
- Model inversion where a cohort output can be partially reversed by a sufficiently motivated adversary.
- Insider abuse by parties with privileged access to the identity or event domain.
What BingBong does not claim.
These statements are explicitly excluded from the design surface. Their absence is part of the design.
- BingBong does not claim true anonymization.
- BingBong does not claim HIPAA compliance.
- BingBong does not claim certification, patents, deployed scale, named customers, or audited performance.
- BingBong does not claim zero reidentification risk.
- BingBong does not claim a specific jurisdiction's data-broker regime is satisfied without a documented review.