Sharing data without sharing people: the boundary architecture

Start with the task

A colleague needs to summarise a case file. The sequence of events matters; the customer’s name may not. Before sharing, decide which details the task requires and which you can replace or remove.

That review complements access controls, encryption and supplier agreements. All of them still have a job to do.

What changes in a record

Synthaveil applies a treatment to selected fields. A reference can become a token, a name can become another name, and a location can be replaced according to a configured policy. Which fields are treated is your configuration decision; review the result before sharing.

Choice	Useful when	Check before sharing
Consistent token	Records need to join within an agreed scope	Settings match across the systems that need to join
Realistic replacement	A reader or model needs a recognisable field type	The replacement suits the task
Less detail	An exact value is unnecessary	The remaining information still supports the task

A realistic-looking record does not guarantee the same analytical result. Test the joins, distributions and calculations your work actually uses.

Where processing happens

A self-hosted Legend engine runs as a library, sidecar or container inside your environment. Your application can process original values locally.

Hosted options send only the values needed for the task to Synthaveil; the product pages and your agreement set out exactly what each one receives. Review that data flow before choosing an option.

Restoration is a separate decision that stays with you; the product pages show where each product keeps the information needed to restore values.

How long should records remain linkable?

Within a scope you set, the same value receives the same stand-in, which can support grouping. Changing the scope changes those stand-ins. It does not delete old records or prevent someone joining them through dates, unusual events or other unchanged context.

Choose the scope around the task and record why you need it. A monthly analysis and a single document may need different settings.

The review you still own

Identifiability depends on what a holder can reasonably use to connect the information to a person. While you hold the key or the originals, the output remains personal data in your hands. For a recipient with no reasonable means to re-identify anyone, the position can differ; that is an assessment you make and record, not a default.

Before sending a copy, confirm the purpose and permissions, check free text and indirect identifiers, agree retention with the recipient, and protect any restoration information separately. Replacing fields does not supply a lawful basis or a notice, and it cannot predict a regulator’s decision.