We help organisations anonymize and share sensitive data with methods you can stand behind in front of a regulator.
Methodological consulting and disclosure-risk assessment for microdata, registers, and longitudinal data. We classify your variables (direct identifiers, quasi-identifiers, sensitive attributes), define the disclosure scenario and sharing mode, measure per-record re-identification risk, and apply targeted methods — generalization, local suppression, PRAM, microaggregation, swapping, noise — tuned against a utility target.
You receive: an anonymized dataset plus a defensible report — methods, parameters, residual risk, and retained utility — that stands up to a regulator or reviewer.
Generation and validation of synthetic datasets that preserve statistical utility while breaking one-to-one links to real individuals. We build synthesis models (e.g. with simPop, synthpop, GANs and others, or individual solutions), then evaluate both sides of the trade-off — fidelity (distributions, correlations, model performance) and disclosure risk (attribute/identity disclosure) — with our own open riskutility tools.
Best when you need to share data widely, build pipelines, or train models without exposing the people behind the records.
Independent review of an existing anonymization or synthetic-data pipeline. We re-measure the disclosure risk under realistic attacker assumptions, check whether the methods match the sharing mode, and identify where utility is being lost needlessly.
You receive: a written second opinion with concrete, prioritised findings — useful before a release, an audit, or a funder/regulator review.
SNF Bridge Discovery What we didOur flagship project: privacy-preserving methods for event and longitudinal data — masking trajectories, protecting event histories, and pushing re-identification-risk assessment beyond k-anonymity.
ImpactOpen, reproducible tools that let organisations analyse and share data following the same people over time, with quantified risk.
Nestlé What we didTwo ongoing engagements under the EU GDPR/EDPB framework. Using a completed study as the worked example, we show the team what anonymization can achieve and how to make the decisions it requires. In parallel, we anonymize the data of a clinical study before the identifiable original is deleted.
ImpactA team that can make anonymization decisions itself, and study data that stays usable after the original is gone, with the measurements that carry the scientific value preserved.
SBB What we didHousehold-level anonymization and geographic protection of SBB's 9-million-person Synthetic Population (SynPop), with a formal disclosure-risk assessment for a differentiated data-release policy.
ImpactIndividual-level population data that can be shared and used safely in agent-based transport models — not the current all-or-nothing.
A first conversation is free, confidential, and usually clarifying.
