Useful answers without exposing people.

Run only approved aggregate templates over active, purpose-bound permissions. Raw records, identities, and individual values never leave the delivery boundary.

Delivery policy v13+ participants60 minute session · 5 query limit

Below-threshold results are suppressed, not approximated.

Identity-aware delivery boundary

Sign in to inspect permissioned delivery.

Individuals can see sessions touching their grants. Authorized organization operators can create and execute aggregate sessions.

Hard boundary

No raw-data export exists.

This phase releases synthetic aggregate JSON only. It does not provide row-level APIs, downloads, arbitrary SQL, external compute, differential privacy, or a production clean-room provider.

Consent withdrawn → grant removed → next result recalculated