Karlsgate Identity Exchange matching process is an orchestrated procedure between 3 locations: (a) your internal network, (b) your trading partner’s internal network, and (c) a cloud-based facilitator node. The important detail is that zero identifying data leaves your environment – only cryptoidentities (one-time, secret keyed hash values derived from the original identifiers) are transmitted to a secure third-party escrow. Cryptoidentities are compared by a Karlsgate-controlled, temporary, virtual machine (facilitator node) hosted by a major cloud provider.
The facilitator and its associated storage escrow are destroyed after every trade. No uploaded data is kept on Karlsgate's servers or cloud servers after a trade. The hashed tokens that are transmitted to the facilitator have no identifying value, since they are scrambled with a shared secret key between two trading partners for the specific trade only that is never communicated to Karlsgate.
Unlike data clean rooms, the facilitator does not exist before each trade it processes and does not rely on any previously stored information.
Karlsgate never receives identifying or pseudonymous data. All data from our point of view is anonymized, since there is no possibility to re-identify individuals from using the data we receive.
The hashed tokens are stored in a secure cloud storage escrow during the matching process. Once the facilitation process is completed, then the virtual machine and escrow storage are purged and decommissioned immediately. There is no residual data storage on our servers.
