Security
How Enjamb Labs holds, de-identifies and delivers the most sensitive records a business has.
Read the methodRaw records live in United States regions only, encrypted at rest and in transit, in storage dedicated to the data programme and separate from the Enjamb platform. Florida provider records stay inside the United States as the state requires. Nothing raw is ever placed on a laptop, a shared drive or a third-party annotation platform.
Raw records are reachable by a small named group under least privilege, with every read logged to the person and the query. De-identification runs as a pipeline, not as people reading files. A buyer never receives raw data and never has access to the environment where it is held.
Nothing crosses the boundary until the method has run and the gates have passed: identifiers replaced with entity-consistent surrogates, dates shifted per entity, rare events generalized, k-anonymity checked on quasi-identifiers, and a re-identification red team that failed to name the seller, a client or an employee from the delivered sample.
Whatever a seller carves out of the licence is hashed at source, and the pipeline refuses any record that matches. Excluded material cannot enter by mistake, and the exclusions annex delivered to a buyer lists categories, never content. Card numbers, bank details and credentials are excluded from every licence by default.
Every delivery is uniquely fingerprinted and carries a watermark that survives reformatting. A file found where the licence does not allow it traces to the buyer it was delivered to. Buyers are contractually barred from re-identification attempts, resale and redistribution.
Enjamb Labs also builds an AI workforce for biopharma at enjamb.ai. Data from customers of that platform is never licensed, never enters this pipeline, and is held in separate systems under separate agreements. The two lines share a legal entity and a design language, and nothing else.
The method
The tension is simple: more context kept means less anonymous. We keep the context a model needs, the sequence, the amounts, the outcome, and remove everything that points at a person or a firm. These are the steps, in order, and each is recorded in the method document that travels with the data.
01
Every field in every system is assigned a sensitivity tier before ingestion: tier 1 for protected and regulated data, tier 2 for clients and counterparties, tier 3 for the seller's own operations. The tier decides how aggressive the next steps are.
02
Deterministic rules for structured identifiers, an open-weight model pass for free text, and a second pass that reads the surrounding context rather than the token alone. The union of the HIPAA eighteen and sixty-plus further classes: account and policy numbers, plates, VINs, device serials, docket numbers, biometric images, unique phrasings a search engine would resolve.
03
Entity-consistent pseudonyms: the same surrogate for the same person, client, payer or vendor in every source, so the corpus stays coherent and the twin stays faithful. Geography is generalized to state. Ages are banded. Account-type identifiers are dropped or replaced with consistent surrogates.
04
Every record belonging to one entity is shifted by the same random offset, so absolute dates are gone and every interval is exact. For health data this is permitted under Expert Determination, which is why we use it rather than Safe Harbor, whose year-only dates would destroy the timelines a lab is paying for.
05
Rare events re-identify. A single very large claim in a small adjuster's book names the firm. The magnitude is bucketed and the workflow is kept, per dataset, tuned to the tier.
06
k-anonymity on quasi-identifiers with k set per tier; a re-identification red team with a model and a person; human QA on a sample; the exclusions check by hash. Any failure returns the dataset to generalization.
07
Per dataset: method (Safe Harbor or Expert Determination), who signed, the identifier classes covered, the date-shift design, k, tiers, red-team result, watermark id. Delivered with the data.
Every record we hold belongs to someone who trusted a business with it. The controls exist so that trust survives the licence.
security@enjamb.aiIn United States cloud regions only, encrypted at rest and in transit, in infrastructure dedicated to the data programme. No raw record leaves the United States, and no raw record is processed by a contractor or annotation platform.
Protected health information is received only under a Business Associate Agreement with the covered entity. It is de-identified under HIPAA Expert Determination by a qualified expert, which permits consistent date shifting; the determination and its parameters are part of the method document. De-identified health corpora are delivered to labs in the United States and allied jurisdictions only.
A small named group at Enjamb Labs, under least privilege, with every access logged. Buyers never do. Sellers retain their own copies and can see the method document for their dataset on request.
Every buyer is screened against United States bulk sensitive data and export rules, and the licence bars re-identification, resale and redistribution. Corpora containing health or financial-account data are not offered outside the United States and allied jurisdictions regardless of de-identification.
No. Every record traces to a named business that licensed it to us directly. The chain of licence is available to a buyer under NDA.
HIPAA Expert Determination is performed per dataset by a qualified expert. A SOC 2 Type II audit is in progress and will be stated here when complete. We do not display certifications we do not hold.
Email security@enjamb.ai. Reports are acknowledged within two business days. Sellers who believe an excluded record was delivered, or buyers who believe a file is misattributed, should write to the same address with the watermark id.
Stated as they stand. Where a certification is in progress it says so, and the card changes only when the report is issued.
Health data de-identified per dataset by a qualified expert, with consistent date shifting documented.
Signed with every covered entity before protected health information is received.
Every buyer and transfer screened; sensitive personal data corpora stay in the United States and allied jurisdictions.
Sellers keep all IP. Buyers may train and evaluate, and may not resell, redistribute or re-identify.
Audit underway. This card will state the report date when it is issued and not before.
