The platform runs where your microdata already lives. It operates only on data your office already lawfully holds, acquires nothing externally on your behalf, and leaves the models it trains with you.
Deployed inside your own infrastructure, or in a sovereign cloud region within your jurisdiction. Microdata does not cross a border. There is no vendor-side copy of your records, because there is no transfer to make one from.
Role-based access control with integration into your institutional identity systems, so access follows the roles your office already administers. Every action is logged — who ran what, against which round, with which configuration, and what they did with the result.
The platform operates on your existing microdata, whichever administrative registers you choose to include, and published macro indicators. It acquires no external data on your behalf, and no data source is added without your office's decision.
Analysis can run against pseudonymized records where your disclosure-control rules require it. Identification is not needed for reconstruction; the record key is.
Client data and the models trained on it remain the client's, inside the client's deployment. Nothing trained on your microdata is carried to another engagement.
The platform produces internal reports for analyst review. It has no publication path of its own — releasing a figure remains an act of your office, taken by your staff, through your existing approval process.
Your microdata never leaves your jurisdiction, no released statistic can be changed by the platform, and the models trained on your data belong to you.
For your data protection officer
We would rather answer the deployment and sovereignty questions early than discover them at contract stage.