How we keep people out of the data we value and bring to buyers.

The engine leaves dates and places in place by default, which the benchmark counts as quasi-identifiers (88.4% of the other people named in the judgments are also masked); those are handled by the table checks, the review and your own lists rather than masked wholesale. Engine version 2026-10-16.4, measured 2026-10-16. The benchmark and its paper: the corpus (MIT licence) and Pilán et al. 2022.

Where it is weakest: organisations' names written as brands or departments, account numbers with no word beside them, and internal links. Those are what the AI reading every sample and the independent test before delivery are for, and what the engine is being improved on next. The benchmark's authors build the engine at the top of the table and say so on the card; the data is invented, so it holds no real person. Engine version 2026-10-18.1, measured 2026-10-18 on the card's revision of 2026-10-15: the benchmark (CC BY 4.0) and its scorer.

1. 1

   The valuation

   What leaves: Counts: how many records, months, authors, links and identifiers by kind, the file types, the few mailbox domains and e-invoice company names that show whose records they are, and one-way hashes of file names and sizes. No text and no names of people.Who does what: Your browser reads your exports; authors are counted through a one-way hash that stays in your browser.The bar: Nothing personal leaves your computer, so nothing needs removing.

2. 2

   A sample for the valuation

   What leaves: A small part of your records, rewritten on your computer by the de-identification engine, with its report of counts.Who does what: You run the engine and read records picked at random; our server checks the text again on arrival, measures it and deletes it at once.The bar: Every identifier replaced, a second check finds none, a person read random records and found none. Not shown to any buyer: its text is deleted once measured.

3. 3

   A buyer's evaluation

   What leaves: A de-identified sample a buyer reads under an NDA, sent by you to the buyer.Who does what: The same engine on your computer, with the delivery's review: records read at random until the upper bound on what is missed is under the threshold.The bar: The delivery checks, short of certification: the buyer reads it only under its signed confidentiality undertaking.

4. 4

   Delivery to a buyer

   What leaves: The licensed records, de-identified, from you (or the provider you choose) to the buyer, not through us.Who does what: The engine or an independent provider rewrites; an independent provider tests and certifies before each transfer; the buyer signs the commitments.The bar: All the checks below, an evidence file with an expiry, a certificate, and the buyer's public and contractual commitments.

1. Rule 1

   Nothing identifying leaves your computer

   The engine runs in your browser. Your original records, the list of people it builds and the key that links stand-ins stay on your computer; what can leave is the rewritten text and a report of counts.

   Software that de-identifies must not itself leak what it removes, and a pseudonym's secret must stay with whoever made it. A scrub that starts after a buyer has the raw files has already given the buyer what it meant to remove.

   Sources

   • “Containment. The software does not leak identifying information in expected or unexpected ways”

     NIST SP 800-188, De-Identifying Government Data Sets, section 5.3 (2023-09)

   • “the transformation needs to involve information that the pseudonymising controller keeps secret and an unauthorised person cannot use. Only possession of the secret information should enable the computation of the pseudonym given the identifier.”

     EDPB Guidelines 01/2025 on Pseudonymisation, para 88 (2025-01-16)

   • “Scale anonymizes everything inside your environment, before any data is extracted.”

     Scale AI, data partnerships (undated, read 2026-10-15)
2. Rule 2

   Several kinds of evidence, never one detector

   Four layers: the people your exports list in their own structure (senders, authors, users, contacts), found wherever they are mentioned; patterns checked against each identifier's own rule (check digits, key formats); names from public dictionaries, greetings, titles and sign-offs; and your own lists of words to remove and to keep.

   Rule-based detectors are best at numbers and formats, learned ones at names, and no detector covers what only the company knows (its clients, codenames and people). Direct identifiers cannot be limited to a fixed list of categories.

   Sources

   • “rule-based systems excelled at finding certain kinds of information (e.g., SSNs and phone numbers), while the trainable systems worked better for other kinds of data”

     NIST IR 8053, De-Identification of Personal Information, p. 31 (2015-10)

   • “not only quasi-identifiers, but also direct identifiers cannot be limited to predefined categories of entities”

     Pilán et al., The Text Anonymization Benchmark (TAB), Computational Linguistics (2022-07-01)

   • “an identifier listed in the Safe Harbor standard must be removed regardless of its location in a record if it is recognizable as an identifier.”

     HHS, Guidance on de-identification of protected health information (2012-11-26)
3. Rule 3

   Every mention of a person, or the person is not protected

   A person counts as protected only when every mention of them is replaced. The engine links each person's name, first name, surname, address and handle to one stand-in, and we measure ourselves the same way.

   One mention left in clear text identifies the person in all the others; a recall averaged over mentions hides exactly that failure.

   Sources

   • “Whenever an entity is mentioned several times in a given document, it only makes sense to view this entity as "protected" if all of its mentions are masked.”

     Pilán et al., TAB, section 6.1 (2022-07-01)

   • “the dataset as a whole should only be considered anonymous if the anonymisation is effective for all of the included individuals”

     EDPB draft Guidelines 02/2026 on Anonymisation, para 36 (2026-07-07 (draft))
4. Rule 4

   Stand-ins from a secret key you keep, never a plain hash

   Each stand-in number comes from a keyed hash (HMAC-SHA-256) under a 256-bit key made on your computer, looked up in a table that holds hashes, never names. A new key for each delivery means two buyers' copies cannot be joined.

   A hash without a secret key is reversed by hashing every possible name, as happened to New York's taxi data; regulators treat such a code as an identifier.

   Sources

   • “Hashing without a key generally does not confer security because an attacker can brute force all possible values to be hashed.”

     NIST SP 800-188, p. 51 (2023-09)

   • “a code derived from a secure hash function without a secret key (e.g., "salt") would be considered an identifying element.”

     HHS, Guidance on de-identification (2012-11-26)

   • “Users of the dataset discovered the hash algorithm and were able to reverse the pseudonymization by iterating through all possible medallion numbers and license numbers”

     NIST IR 8053, p. 17 (New York taxi data, 2014) (2015-10)
5. Rule 5

   A stand-in stays the same within a file, unless the use needs more

   By default a person keeps one stand-in within each file and gets another in the next, so the clues about them cannot be gathered across the archive. Keeping one stand-in across the whole archive is a choice made for a buyer's stated use, and the linked copy then needs its own linkage test. Realistic stand-ins (fictional names) are offered for deliveries.

   A consistent pseudonym lets an attacker collect what a person says in many places, as journalists did with AOL's search logs. Realistic surrogates hide names the detector missed among the fakes.

   Sources

   • “an attacker who reconstructs a pseudonym in many sentences is more likely to re-identify the person by linking auxiliary information about the person contained in the sentences.”

     Lukas et al., Analyzing Leakage of Personally Identifiable Information in Language Models, IEEE S&P (2023)

   • “the existence of the pseudonym allowed matching multiple queries from the same user with one another. Journalists were able to identify several users from those terms”

     NIST IR 8053, p. 12 (AOL search logs, 2006) (2015-10)

   • “Replacement with realistic surrogate values. This approach transforms identifiers, such as George Washington, to surrogates that blend in, such as Abraham Polk.”

     NIST SP 800-188, p. 51 (2023-09)
6. Rule 6

   Details that identify together are coarsened and measured

   In tables, postcodes are cut to their first part (US ZIP codes to three digits, or 000 where those cover 20,000 people or fewer), birth dates to the year and ages to five-year bands topped at 90. Then every row is checked: a delivery may hold no combination of these details shared by fewer than 11 people.

   Most people are unique on postcode, birth date and sex alone. The threshold is the one the European Medicines Agency and Health Canada set for public clinical reports, a re-identification probability of 0.09; we hold every row to it, not an average.

   Sources

   • “It was found that 87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}.”

     Sweeney, Simple Demographics Often Identify People Uniquely (2000)

   • “Both the EMA and Health Canada have set an acceptable probability threshold at 0.09.”

     Branson et al., Trials 21:200 (2020)

   • “For public release it is advisable to use the maximum risk.”

     European Medicines Agency, external guidance on Policy 0070, v1.4, pp. 49-50 (2018-10-15)

   • “The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.”

     45 CFR 164.514(b)(2)(i)(B) (read 2026-10-15)

   • “all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older”

     45 CFR 164.514(b)(2)(i)(C) (read 2026-10-15)

   • “The NHS's standard for publishing health and social care data requires that, for strong anonymisation, k is set to five.”

     UK ICO, Anonymisation guidance (k-anonymity) (2025-03-28)

   • “Utilizing 2000 Census data, the following three-digit ZCTAs have a population of 20,000 or fewer persons.”

     HHS, Guidance on de-identification: the 17 restricted three-digit ZIP codes (2000 Census) (2012-11-26)
7. Rule 7

   A person reads records picked at random

   Rules read every record; a person reads a random sample of the rewritten ones. With nothing found in n records, the share still holding an identifier is below 1 - 0.05^(1/n) at 95% confidence. A sample needs a short reading; a delivery needs enough records for that bound to fall below 1%. Anything found sends the run back.

   Free text does not de-identify in bulk; it needs human judgement. The method is the one used for regulated clinical reports: annotate a random sample, measure recall, and compare the upper 95% confidence limit with the threshold.

   Sources

   • “If the upper 95% confidence limit of the estimated risk was larger than the EMA and Health Canada recommended threshold of 0.09, then transformations were performed on the quasi-identifiers until the estimated upper risk limit was at or below 0.09.”

     Branson et al., Trials 21:200 (2020)

   • “Anonymising qualitative material can be time-consuming. It does not lend itself to bulk processing and can require careful human judgement to determine if people are still identifiable”

     UK ICO, Anonymisation guidance (2025-03-28)

   • “Review the results of the trial de-identification. Correct any coding or algorithmic errors that are detected.”

     NIST SP 800-188, steps 8 and 9 (2023-09)
8. Rule 8

   The result is checked again, and again on arrival

   Every rewritten record is read a second time with no memory of the first pass, and the copy cannot be downloaded while that check finds anything. A sample is checked a third time by our server, with the same rules, before it is measured; anything found and it is refused and nothing is kept.

   Validation means examining the resulting files to make sure nothing identifying slipped through, not trusting the process that made them.

   Sources

   • “Examining the resulting data files to make sure that no identifying information is unintentionally included in file data or metadata.”

     NIST SP 800-188, section 4.6.2 (2023-09)
9. Rule 9

   Content is screened as well as names

   Records about health, children, beliefs, sex life, union membership, ethnicity, crime, biometrics or a person's finances are flagged, and so are HR matters, legal advice and other parties' confidential material. They are not removed by guesswork: you read them and leave them out unless you may share them.

   Removing names does not make an HR file or a client's confidential material yours to sell; objectors in the Spirit Airlines sale fought on exactly that.

   Sources

   • “[d]eidentification addresses whether a record can be traced to a named individual”

     Spirit Airlines sale: association of flight attendants' objection, as reported (2026-09)

   • “Clinical narratives in which a physician documents the history and/or lifestyle of a patient are information rich and may provide context that readily allows for patient identification.”

     HHS, Guidance on de-identification (2012-11-26)
10. Rule 10

    An independent provider tests and certifies before each transfer

    Before a buyer receives anything, a de-identification provider you choose (not the buyer, and not us) tests the copy as an attacker would, with the web, AI assistants and linkage to other data, and certifies it before each transfer, counting the people it found. Health data also needs an expert determination.

    Nobody outside can verify a private party's own scrub. In the Spirit Airlines sale the estate took a lower bid to keep the scrub independent, and the court-appointed ombudsman required a certificate before every transfer. A contract alone does not make data anonymous.

    Sources

    • “The Deidentification Agent shall perform and document quality-control testing reasonably designed to assess whether individuals may remain identifiable through direct identifiers, indirect identifiers, free-text content, unique characteristics, record linkage, or other means.”

      In re Spirit Aviation Holdings, Consumer Privacy Ombudsman supplemental report, Dkt. 1684 (2026-10-05)

    • “Prior to any transfer, and for every transfer thereafter, the third party expert will file an affidavit with the Court certifying that the data transferred has been deidentified.”

      In re Spirit Aviation Holdings, Dkt. 1684 (2026-10-05)

    • “You must consider all practical steps and means that are reasonably likely to be used by someone motivated to identify people whose personal data was used to derive anonymous information. This is known as the motivated intruder test.”

      UK ICO, Anonymisation guidance (motivated intruder test) (2025-03-28)

    • “A prohibition set out in a contract (even if it is legally binding upon its parties) should not be treated as a prohibition by law.”

      EDPB draft Guidelines 02/2026 on Anonymisation, para 34 (2026-07-07 (draft))
11. Rule 11

    The buyer commits, publicly and in writing

    Every licence binds the buyer not to re-identify or try to, not to link the data with other data to identify people, to bind anyone it passes data to on the same terms, to tell you and us if it finds identifiable data, and to accept oversight. We make the same public commitment ourselves.

    California, Texas, Virginia and the FTC define de-identified data by exactly these duties; without the contract and the public commitment, data is not de-identified in their sense, whatever was removed.

    Sources

    • “(2) Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information ... (3) Contractually obligates any recipients of the information to comply with all provisions of this subdivision.”

      California Civil Code 1798.140(m) (2024-08)

    • “Buyer publicly commits (i) to maintain and use the Deidentified Data in deidentified form, and (ii) that it will not intentionally associate the Deidentified Data with any person or household.”

      In re Spirit Aviation Holdings, sale agreement, Dkt. 1463, s.1(c) (2026-08-14)

    • “The company that transfers or otherwise makes the data available should exercise reasonable oversight to monitor compliance with these contractual provisions and take appropriate steps to address contractual violations.”

      FTC, Protecting Consumer Privacy in an Era of Rapid Change, 2012 (2012-03-26)
12. Rule 12

    An evidence file for every release, with an expiry

    Each run writes a report into the copy: the engine and dictionary versions, what was replaced by kind, the tables' smallest groups, what the second check and the human review found, and the checks passed or open. The certificate joins it. It expires after a year, or sooner when the data, the recipient, the purpose or the known attacks change.

    Methods and results have to be documented so that a regulator, a buyer's counsel or an expert can check them, and identifiability rises over time as information and technology change.

    Sources

    • “the Rule does require that the methods and results of the analysis that justify the determination be documented and made available to OCR upon request.”

      HHS, Guidance on de-identification (2012-11-26)

    • “experts have recognized that technology, social conditions, and the availability of information changes over time. Consequently, certain de-identification practitioners use the approach of time-limited certifications.”

      HHS, Guidance on de-identification (2012-11-26)

    • “documentation of the anonymisation process (including for the testing of the supposedly anonymous datasets) makes it possible to demonstrate both the GDPR-compliance of the anonymisation process, and the effectiveness of the anonymisation itself.”

      EDPB draft Guidelines 02/2026 on Anonymisation, para 41 (2026-07-07 (draft))
13. Rule 13

    We say de-identified, with the measured risk

    We call data de-identified and state the measured risk and the threshold it met. We call it anonymous only for a named recipient after the independent test, not as a label.

    No technical mechanism guarantees that de-identified data cannot be re-identified, and a regulator's draft guidance forbids calling identifiable data anonymous or de-identified.

    Sources

    • “this document uses the phrase de-identification to describe this process and recommends avoiding the phrase anonymization, which is typically used to indicate that the de-identification process cannot be reversed, and there is no technical mechanism to ensure that de-identified data cannot be re-identified.”

      NIST SP 800-188, p. 51 (2023-09)

    • “controllers should not use descriptions like "anonymous", "de-identified" or "de-personalised" if individuals are actually still identifiable.”

      EDPB draft Guidelines 02/2026 on Anonymisation, para 40 (2026-07-07 (draft))
14. Rule 14

    The engine is measured on a public benchmark

    We measure the engine on two public benchmarks and publish the result for the part of each we did not look at while building: the Text Anonymization Benchmark, court judgments in which legal annotators marked every identifier, with its strict metric; and PrivacyBench, company Slack, email and document exports in which people marked every identifier by hand, scored with its authors' own scorer beside the engines they published. The scripts that measure it ship with the engine, and so do its tests.

    Detector accuracy varies with the text it reads, vendors' own numbers are rarely checked independently, and a pooled recall hides missed direct identifiers. A tool should be validated on the kind of data it will process.

    Sources

    • “although the standard, mention-level recall seems relatively good at first sight (around 0.7), a closer look a the entity-level recall over direct identifiers ERdi shows a much poorer performance (around 0.45).”

      Pilán et al., TAB, Table 7 discussion (2022-07-01)

    • “de-identification tools should be validated for the specific kinds of data that the agency intends to use.”

      NIST SP 800-188, section 5.2.1 (2023-09)

    • “Presidio (default): entity-level recall on direct identifiers ERdi 0.460, on quasi-identifiers ERqi 0.758, precision 0.761. Neural NER (RoBERTa fine-tuned on OntoNotes v5, zero-shot): ERdi 0.940, ERqi 0.874, precision 0.441.”

      Pilán et al., TAB, Table 7 (test set, values) (2022-07-01)

    • “Tonic built this benchmark and the system that scores highest on it. For that reason this dataset and the metrics have been designed so that anyone can evaluate their own de-identification systems on this data and compare directly to the scores published here.”

      Tonic.ai, PrivacyBench dataset card (v2.5) (2026-10-15)

• Name of a person
  Becomes

  A stand-in that keeps who-is-who[PERSON_3]
  How it is found

  The export's own list of people (senders, authors, assignees, Slack and CRM users) matched wherever they are mentioned, then dictionaries of given names and surnames (public US and Wikidata lists), greetings and sign-offs, titles and speaker labels.
• Email address
  Becomes

  A stand-in that keeps who-is-who[EMAIL_3]
  How it is found

  Address syntax. Shared mailboxes (support@, sales@) and example domains stay; a person's address takes that person's stand-in.
• Phone number
  Becomes

  A stand-in that keeps who-is-who[PHONE_3]
  How it is found

  International or grouped digit runs of 9 to 15 digits, with dates, versions and bare ids told apart.
• Postal address or postcode
  Becomes

  A tag with no link[ADDRESS]
  How it is found

  House number and street in English, Dutch, German, French, Spanish and Italian forms; UK, Dutch, Canadian and US ZIP+4 postcodes by shape, other postcodes after a state or the word postcode.
• Date of birth
  Becomes

  A tag with no link[BIRTHDATE]
  How it is found

  A date next to born, birthday, date of birth or DOB.
• National identity or tax number
  Becomes

  A tag with no link[ID_NUMBER]
  How it is found

  Each country's format and check digit: US SSN and ITIN, UK National Insurance and NHS numbers, Dutch BSN, German tax id, French NIR, Belgian national number, Spanish DNI and NIE, Italian codice fiscale, Swedish, Danish, Norwegian and Finnish personal numbers, Polish PESEL, Indian Aadhaar and PAN, Canadian SIN, Brazilian CPF, Singapore NRIC, Australian TFN; company and tax register numbers (Dutch KvK and RSIN with its 11-proof, US EIN by its IRS prefix, also written in a form's boxes, EU VAT numbers); passports and driving licences after their name.
• Card number
  Becomes

  A tag with no link[CARD]
  How it is found

  13 to 19 digits that pass the Luhn check and start like a card.
• Bank account number
  Becomes

  A tag with no link[IBAN]
  How it is found

  IBAN shape and its mod-97 check; other account numbers after account or routing words.
• Customer, employee or account number
  Becomes

  A stand-in that keeps who-is-who[ACCOUNT_3]
  How it is found

  A number or code right after customer, client, account, member, employee, staff, badge, patient, policy, order, case, application or user id; codes that carry their kind (SF-EMP-45731, ACC-201029); a code beside a person's email or phone in a contact line; every later code of the same shape in the same export (PFE-208814 once labelled an employee id makes PFE-219337 one too); masked numbers (****4126); every value in a column named that way; payment processors' customer, card, invoice and charge ids (Stripe's cus_, pm_, in_, ch_); SEPA creditor identifiers; and Bitcoin and Ethereum wallet addresses (Bitcoin by its checksum).
• IP address
  Becomes

  A stand-in that keeps who-is-who[IP_3]
  How it is found

  Public IPv4 and IPv6 addresses; private and local ranges stay.
• Device id
  Becomes

  A stand-in that keeps who-is-who[DEVICE_3]
  How it is found

  MAC addresses by shape; IMEI, advertising and device ids after their name.
• User id or handle
  Becomes

  A stand-in that keeps who-is-who[HANDLE_3]
  How it is found

  Slack and Teams mentions, @handles in prose, LinkedIn member ids (ACoAA...), and user-id fields; a known person's handle takes that person's stand-in.
• Personal or internal link
  Becomes

  A tag with no link[LINK]
  How it is found

  Profile links (LinkedIn, X, Facebook, Instagram, GitHub users, Calendly, WhatsApp, Telegram), private file and workspace links (SharePoint, OneDrive, Google Drive and Docs, Dropbox, Box, Notion, Confluence and Jira, Slack archives, meetings), links that carry an email address or a token, and links to an organisation the engine replaces.
• Precise location
  Becomes

  A tag with no link[LOCATION]
  How it is found

  Latitude and longitude pairs with four or more decimals (about 11 metres).
• Name of an organisation
  Becomes

  A stand-in that keeps who-is-who[ORG_3]
  How it is found

  The export's own email domains (hudsonandvine.com makes Hudson & Vine one wherever it is written), a legal or trade word after a capitalised name (Eastman Farms LLC, Meridian Studios), the name learned from it for the rest of the export, and the companies listed with the US Securities and Exchange Commission. Names you keep (usually your own company) stay.
• Password, key or token
  Becomes

  Removed[SECRET]
  How it is found

  The published formats of AWS, Google, Azure, GitHub, GitLab, Slack, Stripe, Twilio, SendGrid, OpenAI, Anthropic and npm keys, private keys, JWTs, passwords in connection strings and links, and assignments to password, secret, token or key.
• Term you asked to remove
  Becomes

  A stand-in that keeps who-is-who[TERM_3]
  How it is found

  The words you list, matched whole, in any case.

• Health information from care, insurance or a health client

  We leave it out.

  • “determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual”

    45 CFR 164.514(b)(1) (read 2026-10-15)

• Recordings of voices and pictures of faces

  Unless the people in them consented in writing to AI training and sale; transcripts are rewritten instead.

  • “four top-performing systems that initially achieved an EER ≥ 40% were later shown to be vulnerable to attacks that reduced EERs to less that 20%.”

    The VoicePrivacy 2024 Challenge overview (2026-01-17)

• Data about children

  We leave it out.

  • “personal information of, or data knowingly collected from, children”

    micro1 data licence master terms, s.5.7 (2026-10-07)

• Customer transaction systems (orders, payments, loyalty profiles)

  Unless taken out whole rather than scrubbed, as in the Spirit Airlines sale.

  • “By excluding the structured Spirit passenger systems from the sale, that data will not be subject to deidentification and will not be provided to the successful bidder in any form, deidentified or not.”

    In re Spirit Aviation Holdings, Dkt. 1684 (2026-10-05)

• Writing style

  Long texts by one author can identify them by style even with every name gone. We flag small groups; we cannot rewrite how people write.

  • “In over 20% of cases, our classifiers can correctly identify an anonymous author given a corpus of texts from 100,000 authors”

    Narayanan et al., On the Feasibility of Internet-Scale Author Identification, IEEE S&P (2012)

• What a trained model remembers

  A model trained on the data can repeat what the scrub missed. The licence requires the buyer's own controls on training and outputs.

  • “Scrubbing techniques reduce but do not prevent the risk of PII leakage: in practice scrubbing is imperfect and must balance the trade-off between minimizing disclosure and preserving the utility of the dataset.”

    Lukas et al., Analyzing Leakage of PII in Language Models, IEEE S&P (2023)

• Combinations of ordinary facts

  A role, a project, a date and a place can single someone out in prose where no table check reaches. The human review and the independent attacker test are there for this.

  • “we find that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes.”

    Rocher, Hendrickx and de Montjoye, Nature Communications 10:3069 (2019)

• Most buyers of company data

  Scrub in-house after receiving the files, publish no method or measured accuracy, and make the seller warrant consents and indemnify them.

  • “Licensor has obtained all consents, opt-ins or other valid legal bases required under applicable data protection and privacy laws”

    micro1 data licence master terms, s.5.3 (2026-10-07)

• The court in the Spirit Airlines sale

  Independent de-identification agent, quality-control testing, an affidavit before every transfer, the buyer's public commitment and flow-down; the estate preferred this to a higher bid that scrubbed in-house.

  • “The Debtors have structured the sale transaction so that a key component is having an independent expert conduct the deidentification of Spirit data. micro1 proposed to conduct the deidentification themselves and not to use an independent party.”

    In re Spirit Aviation Holdings, Dkt. 1684 (2026-10-05)

• Data marketplaces

  Bar identifiable personal data in their terms and rely on the provider's own declaration and indemnity; none tests the de-identification.

  • “Databricks is not obligated to monitor the information Partner furnishes in Listings or Products”

    Databricks Marketplace data partner program overview (2026-05)