Anonymity engineering: Five technical controls for intake integrity
Technical analysis of five identity leakage vectors in feedback portals and the cryptographic controls required to mitigate them.
Yves Research · Platform team
Publishing a privacy policy does not protect contributor identity. Verifiable anonymity requires rigorous architectural controls across network routing, client-side rendering, and data persistence layers.
Five architectural leakage vectors
- Network headers: Ingestion edge proxies strip client IP addresses, user agents, and referral metadata prior to payload persistence.
- Tracking beacons: Portals operate with zero third-party analytics scripts, persistent browser cookies, or cross-domain tracking pixels.
- External font and asset CDNs: Third-party font delivery leaks visitor network addresses to external providers. Yves bundles and self-hosts all assets directly from the deployment origin.
- Small-cohort aggregations: Public reporting for small cohorts or niche departments can inadvertently de-anonymize respondents. Differential privacy thresholds automatically suppress reporting on categories below minimum sample limits.
- Unredacted narrative fields: Free-text inputs frequently contain personal names or identifying details. Ingestion pipelines apply automated PII detection and redaction before analytics aggregation.
Rate verification without persistent tracking
To prevent denial-of-service and automated ballot-stuffing without compromising privacy, intake endpoints generate short-lived, salted cryptographic tokens. These tokens do not persist personal identity or track cross-session activity, but provide sufficient entropy to identify automated burst submissions.
Verifiable anonymity requires proactive defense across every network boundary, ensuring contributor safety while preserving data integrity.
