Two companies want to analyse their combined data without either seeing the other's records. What makes that architecturally possible?

What makes it possible

Query restrictions enforced by the platform rather than by trust. Each party contributes data, neither can read the other's rows, and only queries meeting defined criteria are permitted to run.

The mechanisms:

• Approved query templates, so an arbitrary query cannot be run against the joined data.
• Minimum aggregation thresholds: a result must cover at least some number of individuals, preventing a query that isolates one.
• Output review or automated checks before results are released.
• No raw row access for either party, enforced by the platform's own access control rather than by agreement.

The attack the thresholds exist for

Differencing. Two permitted aggregate queries that differ by one individual reveal that individual, and neither query violates a threshold on its own.

Defending against it requires tracking the queries in combination — a query budget, or noise added to results — which is meaningfully harder than applying a threshold per query and is the part most implementations omit.

What must be agreed before anything technical

• What questions may be asked, since the query templates encode this and expanding them is a negotiation.
• What the join key is, and how it is protected. A shared identifier is itself a privacy concern, which is why hashed or tokenised join keys are used — and a deterministic hash of an email is not anonymous.
• Who sees the output, and whether it may be exported.
• The retention and deletion of the contributed data.

The honest limitation

A clean room reduces exposure; it does not eliminate inference. With enough permitted queries, or with external knowledge, a determined party can learn more than intended — and the protections are statistical rather than absolute.

That should be stated to both parties rather than presented as a guarantee, because the guarantee is what makes participants careless about the query set, which is where the actual risk lives.

Where it genuinely fits

Measurement and overlap analysis between partners — audience overlap, campaign attribution, supply-chain matching — where the aggregate answer is the product and the row-level data is not.

It does not fit anything requiring row-level operational decisions, which needs a data-sharing agreement rather than a clean room.