Skip to content
DataDouble Get a valuation
Trust center

Privacy is the product.

Companies trust us with their most sensitive records, and labs trust us to deliver data that’s clean. This page explains exactly how we earn both.

Our commitments
  • We never sell raw data.
  • We never attempt to re-identify data we have de-identified.
  • Every dataset is attacked for re-identification before release.
  • Every buyer is contractually barred from re-identifying anyone.
  • Nothing ships without the seller’s sign-off.
Why it matters

The people in the data never asked to be in a training set.

Reporting on this market has raised a fair concern. When raw Slack and email archives change hands, the employees and customers who wrote them lose control of their words.

We built DataDouble so raw records never reach a buyer. Every release is de-identified, attacked and approved before it leaves.

Source: Forbes, via Newser (April 2026)
The pipeline

Five layers, applied to every record.

  1. 01Detect

    Pattern rules, entity models and LLM reviewers flag direct identifiers in text, transcripts, documents, images and metadata: names, contact details, account numbers, faces, voices and more.

    Example
    maria.okafor@willowbrookdental.comFlagged: EMAIL
  2. 02Replace

    Each identifier becomes a consistent surrogate, so threads, calls and documents still read naturally and keep their structure.

    Example
    Maria Okafor[PERSON_1]
  3. 03Generalize

    Quasi-identifiers such as exact dates, rare job titles, small towns and deal sizes are coarsened until no combination of fields points to one person or company.

    Example
    March 3, 2026[DATE: Q1 2026]
    VP of Treasury, Boise[FINANCE LEAD, US-WEST]
  4. 04Attack

    A separate red team runs linkage, attribute-inference and membership-inference attacks on the output. Anything that can be re-identified goes back through the pipeline.

    Example
    Link threads to public profilesNo match
  5. 05Approve

    You receive a sampled report and approve each release. Nothing ships without your sign-off.

    Example
    Release DD-0142Approved by seller
Where processing happens

Your cloud or ours. Your choice.

Raw data stays with you

Clean room in your cloud

Our pipeline runs inside your AWS, Google Cloud or Azure account. Raw data never leaves your infrastructure. Only approved, de-identified output is exported.

  • Deployed with read-only access to source systems
  • Your keys and your logs
  • You review output before anything is exported
Fastest to start

Isolated DataDouble environment

Send an export to a single-tenant, encrypted environment provisioned for your company alone. Raw data is deleted once your release is approved, and you receive a deletion certificate.

  • Single-tenant and encrypted
  • Access limited to named staff on your engagement
  • Deletion certificate when the work is done
What every buyer signs

Six terms in every license.

These clauses are not negotiable. A lab that won’t sign them doesn’t get access.

§ 1

No re-identification

Buyers may not attempt to identify any person or company in the data, alone or combined with other data.

§ 2

No resale or redistribution

Licensed data stays with the licensee and its authorized researchers.

§ 3

Purpose limits

Use is limited to the purposes named in the license, such as training, evaluation or research.

§ 4

Security requirements

Licensed data must be stored with access controls, encryption and logging.

§ 5

Audit and enforcement

We can audit compliance. Breaches carry financial penalties and termination of the license.

§ 6

Deletion at term end

Licensed copies are deleted when the license ends, with written confirmation.

Standards

Built around the standards your counsel will ask about.

HIPAA
For health-related data, de-identification follows the Safe Harbor or Expert Determination methods in 45 CFR §164.514(b).
GDPR
Releases are designed to meet the anonymization standard described in Recital 26, under which data that can no longer identify a person falls outside the regulation.
CCPA and CPRA
California’s definition of deidentified information requires technical safeguards, a public commitment not to re-identify, and contractual obligations on every recipient. Our pipeline, the commitments on this page and § 1 of every license cover all three.
Your contracts
We review customer agreements and data processing addenda for limits on secondary use before anything is licensed.

This page describes our process. It is not legal advice, and every engagement is reviewed by counsel.

Security

How we handle data while it’s in our care.

Encryption

Data is encrypted in transit and at rest, with keys scoped to each engagement.

Least-privilege access

Only named staff on your engagement can reach your environment, and every access is logged.

Single-tenant processing

Each seller’s data is processed in its own isolated environment and never pooled with anyone else’s.

Complete audit logs

Every read, transform and export is recorded and available to you on request.

Controlled human review

Reviewers work under NDA in monitored, locked-down workspaces.

Scheduled deletion

Raw data is deleted on a fixed schedule once each release is approved.

Found a privacy or security issue?

Tell us right away. We respond to every report.

security@datadouble.us privacy@datadouble.us