Threat model · 3 min read
What the recipient holds: a threat model for data you have already shared
Seven ways a shared record can lead back to a person, and a practical review of what the recipient could infer.
[ 08 / documentation ]
From the drafting table.
Longer reads for the people who have to defend a decision: how the boundary architecture works, what to do when a vendor announces an AI transformation, and what the regulators actually say.
Architecture · 3 min read
Sharing data without sharing people: the boundary architecture
A practical guide to choosing which identifying fields leave your systems, where processing happens and what you still need to review.