Privacy-preserving record linkagerunning selftest

Two firms find their shared clients.
Neither one sees the other’s list.

Every client record is reduced to a 512-bit Bloom filter before it leaves the firm. The matcher compares filters, never names. Below is that system, running: encoding in your browser, scoring on the server, calibrated against a labelled set with the failure cases left in.

5/11
Found by a plaintext SQL equi-join. It misses every spelling variant, nickname and reformatted field.
.../11
Auto-linked by fuzzy CLK matching at Dice , with zero false positives.
...
Pairs in the ambiguous band, of candidates. Human review, not a threshold.
...
Recall once the review queue is worked. Nothing real is silently dropped.

Inside each firm

These rows never move. Encoding happens here, in the browser, under a salt the matcher operator never holds. Green rows are auto-linked; amber rows land in the review queue.

SAMPLE DATA

Aldgate Trust

Client list, plaintext, local only
RefNameBornPostcode
A01Amelia Hartley1984-03-02M1 4BT
A02Jonathan Smith1979-11-24SW1A 1AA
A03William Okonkwo1991-07-16LS1 5QT
A04Priya Raghunathan1988-02-29EH3 9DR
A05Grace Abadi1995-05-08BS1 6NB
A06Thomas Wexley1972-09-30NE1 7RU
A07Fiona Castellane1990-12-11CF10 1EP
A08Rory Nkemelu1983-01-19B15 2TT
A09Helena Vorst1968-04-25G2 8DL
A10Marcus Delacroix1987-08-03SW1A 1AA
A11Ada Whitfield1993-06-14M1 4BT
A12Samuel Whitfield1996-06-14M1 4BT
A13Ingrid Lindqvist1975-10-05EH3 9DR
A14Oscar Bennett-Rowe1999-03-21LS1 5QT
SAMPLE DATA

Barbican Mutual

Client list, plaintext, local only
RefNameBornPostcode
B01Amelia Hartley1984-03-02M1 4BT
B02Jonathon Smyth1979-11-24SW1A 1AA
B03Bill Okonkwo1991-07-16LS1 5QT
B04Priya Raghunathan1988-02-29EH39DR
B05Grace Abadi-Mensah1995-05-08BS1 6NB
B06Thomas Wexley1972-03-09NE1 7RU
B07Fiona Castellane1990-12-11CF10 1EP
B08Rory Nkemelu1983-01-19B15 2TT
B09Nadia Ferreira1981-02-17G2 8DL
B10Marcus Delacroix1987-08-03EC2Y 8DS
B11Ada Whitfield1993-06-14M1 4BT
B12Sam Whitfield1996-06-14M1 4BT
B13Yusuf Demirci1970-08-22L1 8JQ
B14Clara Bennett1999-03-21LS1 5QT
Trust boundary. Only 512-bit filters cross. No name, date of birth or postcode is transmitted.verify in DevTools, Network, /api/match

What the matcher receives

Fourteen filters cross from each firm; the first four of each are drawn here. Hover a result row below and the bits both filters set light up: that intersection, and only that, is what the Dice score is computed from.

encoding…

Results

Ranked by Dice similarity. The last column is what a plaintext equi-join would have returned for the same pair, which is the baseline this replaces.

Aldgate TrustBarbican MutualDiceVerdictExact joinWhy it is hard

PPRL Linkage Workbench. Built for a proposal by Muhannad. Sample data is invented; no real client list is represented. Method after Schnell, Bachteler and Reiher (2009); hardening after Alaggan, Gambs and Kermarrec. Engine and assertions at /api/selftest.