---
title: "Privacy"
description: "125 posts about Privacy, summarised, each linking to the original."
---

# Privacy
> 125 posts about Privacy, summarised, each linking to the original.

## Articles

### [Differential Privacy for Hugging Face Trainers – Without Rewriting Your Training Loop](https://yomu.fyi/post/differential-privacy-for-hugging-face-trainers-without-rewriting-your.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Katie Fraser
- Published: Aug 27, 2026
- Type: Announcement

Training large language models on sensitive data risks memorization and membership inference attacks, yet standard high-level transformer tools lack native differential privacy capabilities. JetBrains Research created and open-sourced DPTrainer, a library that integrates PyTorch's Opacus framework with the Hugging Face Trainer ecosystem. The library provides differential privacy through differentially private stochastic gradient descent without requiring manual training loops or source code modifications. DPTrainer extends base training arguments with a PrivacyArguments dataclass, managing per-sample gradient calculation, gradient clipping, noise injection, and Poisson-sampled data loading. A dynamic patching mechanism injects differential privacy into specialized subclasses like DPOTrainer and SFTTrainer, while built-in privacy accountants track the cumulative privacy budget across training steps and checkpoints.


### [Advancing Claude for Education](https://yomu.fyi/post/advancing-claude-for-education.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Aug 27, 2026
- Type: Announcement

Claude for Education is adding integrations with Canvas, Panopto, and Wiley to bring course materials, lecture transcripts, and peer-reviewed content into student conversations. Canvas LTI lets students use Claude inside courses, while Wiley and Panopto connect through pre-built MCP servers. Conversations are private by default, excluded from AI training by default, institutional data requests require formal approval, and self-serve data exports are limited by default. The announcement also covers new institutional partnerships, a tenfold expansion of the student ambassador program, and Claude Builder Clubs featuring hackathons, workshops, and demo nights. It frames responsible collaboration, ethics, privacy, and equitable access as necessary to avoid deepening existing divides while AI transforms education.


### [How to evaluate session replay software: a developer's guide](https://yomu.fyi/post/how-to-evaluate-session-replay-software-a-developer-s-guide.md)
- Company: [Sentry](https://yomu.fyi/company/sentry.md)
- Author: Lindsay Piper
- Published: Aug 26, 2026
- Type: Explainer

Session replay software varies fundamentally based on architecture, distinguishing tools designed for product analytics from those built for developer debugging. Recording approaches split into DOM snapshot and mutation capture, which optimizes for compression and structured debugging, versus pixel capture, which favors visual fidelity for complex animations. Privacy depends heavily on masking location, where client-side masking redacts data before network transmission, whereas server-side scrubbing acts after transmission. For engineering teams, integration depth connects replays natively to traces, console errors, and backend issues rather than requiring timestamp lookups across separate products. Performance costs across CPU, memory, and network require benchmarking on target applications alongside strategies like error-based sampling.


### [Leveraging Databricks to Support FISC Security Guidelines](https://yomu.fyi/post/leveraging-databricks-to-support-fisc-security-guidelines.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Jarrett Hoffman, Abhi Arikapudi
- Published: Aug 26, 2026
- Type: Explainer

The FISC Security Guidelines define control objectives for Japanese financial institutions, while the post addresses the challenge of translating them into auditable controls on Databricks data and AI workloads. The Databricks Data + AI Platform, Unity Catalog, and optional Enhanced Security Monitoring and Compliance Security Profile features are presented for identity and network controls, encryption, fine-grained access, audit logs, lineage, and hardened runtimes. For AI workloads, Unity Catalog’s Model Registry links training data, code versions, and evaluation metrics to model versions, while a separate framework maps 97 AI-specific risks to 73 controls. The FISC Customer Capabilities Mapping Matrix connects guideline units to platform capabilities and customer responsibilities, including configuration, SIEM integration, backup, recovery, and evidence; the Security Analysis Tool is suggested for finding workspace gaps, and the material is identified as educational guidance requiring expert review.


### [Migrating to Auth0 for Startups from Another Auth Solution](https://yomu.fyi/post/migrating-to-auth0-for-startups-from-another-auth-solution.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Shreya Gupta
- Published: Aug 26, 2026
- Type: Problem & solution

Evenpay develops compensation transparency software to meet the EU Pay Transparency Directive, requiring strict safeguards for sensitive employee salary data. The startup initially selected a lightweight B2B authentication platform for quick onboarding, but soon encountered unmet data residency and compliance demands from Finnish enterprise clients. To resolve these limitations, Evenpay migrated all customers to Auth0 over a few weeks using documentation and AI assistance. Adopting Auth0 allowed the team to fulfill regional EU data controls while reducing managed Single Sign-On setup times from weeks to as little as one day through self-service options. Furthermore, relying on an established authentication brand provided instant credibility with enterprise security officers without requiring custom authentication development.


### [How Suprema Gaming made its data platform agent-ready with ClickHouse Cloud](https://yomu.fyi/post/how-suprema-gaming-made-its-data-platform-agent-ready-with-clickhouse.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Aug 25, 2026
- Type: Problem & solution

Suprema Gaming migrated its analytics platform from Snowflake to ClickHouse Cloud on AWS as part of a company-wide move toward agentic operations. The previous stack delivered data about four hours late, required heavy dbt rebuilds, and often took minutes to answer queries, limiting real-time investigations and interactive analysis. Suprema rebuilt ingestion with ClickPipes for supported sources and Debezium plus Kafka for others, while dbt and GitHub Actions deploy the warehouse-layer structure without external cron jobs, Airflow, or a separate orchestrator; governed access uses role-based controls and query-time PII masking. Before cutover, every metric was validated against the reference source, and the resulting platform reduced warehouse spend by roughly 62%, improved direct-read performance 27x, and maintains about one-minute p95 freshness, supporting an early production deployment of ClickHouse Agents.


### [Project Lighthouse — Part 3: Introducing project-lighthouse-anonymize](https://yomu.fyi/post/project-lighthouse-part-3-introducing-project-lighthouse-anonymize.md)
- Company: [Airbnb](https://yomu.fyi/company/airbnb.md)
- Author: Adam Bloomston
- Published: Aug 25, 2026

Airbnb has open-sourced project-lighthouse-anonymize, a Python library powering their privacy-preserving anonymization used to measure user experience disparities. The release is accompanied by technical papers detailing Core Mondrian, an extended partition-based anonymization algorithm, alongside a framework for measuring anonymized data quality. The library enforces k-anonymity and p-sensitive k-anonymity while offering built-in data quality metrics.


### [Choosing Data Governance Tools for Enterprise Data Governance](https://yomu.fyi/post/choosing-data-governance-tools-for-enterprise-data-governance.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Databricks Staff
- Published: Aug 25, 2026
- Type: Explainer

Enterprise data governance tools address fragmented data estates in which teams struggle to locate assets, identify ownership, protect sensitive information, and maintain consistent quality across warehouses, lakes, SaaS applications, and spreadsheets. Positioned above storage and compute, these tools read metadata, schemas, and query logs to provide a shared governance layer for cataloging, lineage, classification, policy enforcement, quality monitoring, and audit reporting. The guide distinguishes standalone catalogs, point solutions, enterprise suites, platform-native tools, and open-source options while treating AI and agent governance as an increasingly important capability for models, prompts, and autonomous agents. It recommends evaluating candidates against seven criteria, comparing total cost of ownership, and planning a phased rollout that starts with highest-risk domains; a lakehouse-native approach can reduce synchronization between separate governance systems.


### [Auth0, Made for Whatever You Are Building](https://yomu.fyi/post/auth0-made-for-whatever-you-are-building.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Chris Sevilleja
- Published: Aug 25, 2026
- Type: Problem & solution

Rapid application development with AI coding tools often produces unreviewed custom authentication logic that handles sensitive Personally Identifiable Information and regulatory requirements like HIPAA. Autonomous AI agents compound these security challenges by significantly widening an application's overall attack surface. Standardizing on Auth0 provides an established identity layer that integrates into agentic workflows via Claude plugins, an Auth0 MCP server, and standardized agent skill packages. This setup exposes Auth0 Management APIs and official documentation directly to AI agents, achieving integration times of three to four minutes according to Agent Experience metrics. Incorporating these pre-built patterns maintains security baselines while supporting scaling requirements across B2B plans for initial user bases up to 1,000 monthly active users.


### [Your alt text passes automated checks. That doesn’t mean it’s any good.](https://yomu.fyi/post/your-alt-text-passes-automated-checks-that-doesn-t-mean-it-s-any-good.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Taarik Ashenafi
- Published: Aug 24, 2026
- Type: Explainer

Automated accessibility checkers reliably flag missing alt text attributes but frequently miss unhelpful descriptions like raw filenames or repetitive labels. To evaluate image description quality without generating excessive false positives, GitHub built an alt text plugin for the GitHub Accessibility Scanner. The tool combines five deterministic, zero-credential rules that evaluate strings and visual layout spacing with an opt-in vision model check for subjective context. Page context including headings and surrounding prose is extracted alongside images to guide the model using structured outputs and explicit anti-nitpick instructions. While deterministic checks catch unwritten text, the model-driven rule serves as an opt-in prompt for human review rather than an absolute verdict.


### [Junie Can Now Run Entirely on Your Mac – No Credits, No Cloud](https://yomu.fyi/post/junie-can-now-run-entirely-on-your-mac-no-credits-no-cloud.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Dmitry Savelev
- Published: Aug 24, 2026
- Type: Announcement

JetBrains has introduced Junie Local, a feature that runs the Junie coding agent entirely on local hardware without cloud dependencies, subscriptions, or credit meters. Users execute a single command inside Junie to download a 4-bit quantized Qwen3.6-27B model, requiring an Apple M5 Mac with 64 GB of RAM. The team prioritized prefill throughput over pure generation speed by utilizing 8-bit arithmetic instructions on the M5 Neural Accelerator, which increased prefill throughput by approximately 40%. Performance optimizations also include KV-cache reuse, speculative decoding to double generation speed, and disabling reasoning to preserve performance. In JetBrains' evaluations, the local configuration performed comparably to cloud-based Sonnet 4.5 on everyday tasks while ensuring source code, diffs, and prompts never leave the local environment.


### [Say it once: introducing Bot Preference Sync](https://yomu.fyi/post/say-it-once-introducing-bot-preference-sync.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Jin-Hee Lee
- Published: Aug 21, 2026
- Type: Announcement

Cloudflare announced Bot Preference Sync, a feature across all customer tiers that automatically reflects dashboard AI bot configurations directly in a site's robots.txt file. Website operators previously faced challenges synchronizing static robots.txt directives with edge enforcement rules, which led some crawlers to ignore stated preferences or attempt bypasses. Under this system, Cloudflare generates and prepends directives for Search, Agent, and Training categories to existing robots.txt files using crawler lists tracked in BotBase. Mixed-use crawlers performing both search indexing and training must meet strict transparency criteria, including honoring opt-outs and providing page-level visibility, to avoid edge blocks when training is disallowed. Additionally, onboarding workflows allow ad-supported publishers to automatically set AI model training to Disallow by default while retaining search visibility.


### [Inbound Private Link now supports account-level Genie One, the account console, and custom URLs](https://yomu.fyi/post/inbound-private-link-now-supports-account-level-genie-one-the-account.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Robert Zhang, Manish Bansal, Chen He, Yankai Zhang
- Published: Aug 20, 2026
- Type: Announcement

Databricks has expanded Inbound Private Link in Beta on AWS and Azure to cover account-level resources, including account-level Genie One, the account console, Governance Hub, and account-level APIs. The update also supports custom URLs and Managed Disaster Recovery stable URLs, while one shared General Access endpoint in any region can serve workspace and account-level UI and API resources, removing the need for one endpoint per region or workspace. These capabilities use context-based ingress, where account admins define allow and deny rules by caller identity, network source, and destination through account and workspace policies. Enabling private access to account-level resources requires registering and allowlisting a General Access endpoint with the account-policy and resolving the custom URL to that endpoint. Existing workspace-specific URLs, private access settings, and IP access lists continue to work in parallel, while service-direct and SCC relay endpoints retain per-region requirements.


### [How Clario technology detects PHI/PII in DICOM images using Amazon Bedrock](https://yomu.fyi/post/how-clario-technology-detects-phi-pii-in-dicom-images-using-amazon-bed.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Alex Boudreau
- Published: Aug 19, 2026
- Type: Problem & solution

Clario developed an automated PHI and PII detection solution on AWS to process thousands of DICOM image slices and PDF files in clinical trials. Medical imaging workflows require strict privacy compliance under HIPAA, GDPR, and ICH E6 guidelines across standard tags, custom vendor metadata, and pixel-burned text. To address this, the pipeline retrieves files from Amazon S3 and runs memory-intensive detection workloads on Amazon EKS backed by Amazon RDS for PostgreSQL. Amazon Textract handles optical character recognition, while Anthropic's Claude Sonnet on Amazon Bedrock classifies sensitive data using domain-optimized prompt engineering. The system identifies precise coordinates and sensitive entity types rather than directly altering files, enabling human-in-the-loop review before downstream redaction occurs.


### [Hello, Ireland! Sending SMS in Twilio’s Ireland Region](https://yomu.fyi/post/hello-ireland-sending-sms-in-twilio-s-ireland-region.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Gary Spencer
- Published: Aug 18, 2026
- Type: Tutorial

Twilio’s Ireland region, IE1, provides EU data residency for Programmable SMS, keeping personal data such as recipient phone numbers and message bodies in the EU through the supplier edge. Adopting it requires separate IE1 credentials and an IE1 Messaging Service, while US1 Messaging Services cannot be reused; SMS to and from +1 numbers, RCS, and WhatsApp are not currently supported. For API calls, the main code change is replacing api.twilio.com with api.dublin.ie1.twilio.com, while client SDK users switch the region parameter from us1 to ie1 and can retain the Dublin edge. Twilio’s logs include a region filter to verify where messages were processed, and the post notes that Studio and TaskRouter support in IE1 is still an initiative.


### [The prototyping tax is killing your AI roadmap](https://yomu.fyi/post/the-prototyping-tax-is-killing-your-ai-roadmap.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Navdeep Alam, Zhe Sun
- Published: Aug 17, 2026
- Type: Problem & solution

The post argues that the “prototyping tax”—delay between an AI-powered idea and a working MVP—causes initiatives to lose momentum, often because organizational context is fragmented across teams, tools, and codebases. Traditional encapsulation and siloed domain knowledge can leave agents with syntax and contracts but not business intent, making production codebases harder to navigate than personal projects. The proposed response is agentic development grounded in business semantics and governed data, with alignment occurring through working builds while CI/CD, code review, and production rigor remain unchanged. The post recommends tracking time-to-prototype, first-pass acceptance rate, and PoC-to-production rate to distinguish faster demos from durable delivery. It cites a benchmark of 401 data tasks and Abacus Insights results: 77% accuracy at roughly half the cost for a platform-native agent, plus about 40% less manual effort and onboarding to first value in roughly half the time.


### [Recovery strategies to meet data residency requirements](https://yomu.fyi/post/recovery-strategies-to-meet-data-residency-requirements.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Jamie Pasterick
- Published: Aug 13, 2026
- Type: Explainer

Organizations operating under data residency requirements must balance jurisdictional compliance with disaster recovery objectives for critical workloads on AWS. In locations served by a single Region or facing multi-Region constraints, three architectural patterns offer distinct trade-offs between regulatory adherence and operational complexity. The cryptographic boundary approach replicates encrypted data to another AWS Region while restricting decryption access using AWS Key Management Service policies. The data boundary pattern deploys AWS Outposts on-premises within the source country while relying on an external parent Region control plane. Finally, strict local autonomy boundaries retain data and control planes entirely in-country through on-premises systems or multi-cloud lifeboats, requiring rigorous end-to-end continuous testing.


### [How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees](https://yomu.fyi/post/how-we-re-building-scam-alert-on-whatsapp-with-end-to-end-encryption-a.md)
- Company: [Meta](https://yomu.fyi/company/meta.md)
- Published: Aug 12, 2026
- Type: Announcement

WhatsApp presents an early technical overview of Scam Alert, an optional feature that uses an on-device machine learning model to identify potential scam messages from non-contacts while keeping message content on the device. The warning appears only to the user, who can block, report, continue, or mark a chat trusted; reporting and sharing require explicit user action. To measure performance, the system sends locally aggregated warning and user action counts through confidential federated analytics using Trusted Execution Environments and differential privacy, rather than transmitting raw signals. Model versions are recorded on a public transparency ledger, while published weights, client-side logs, and an expanded Bug Bounty program support independent inspection of delivery and behavior.


### [How to ground Genie Agents in both structured data and documents without losing governance](https://yomu.fyi/post/how-to-ground-genie-agents-in-both-structured-data-and-documents-witho.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Doyoung Jung
- Published: Aug 10, 2026
- Type: Explainer

Databricks Genie Agents can combine structured tables and unstructured documents, but the central challenge is preserving data governance when one agent can access both. The proposed architecture runs agents with the end user’s credentials, using Unity Catalog identity synchronization, object privileges, ABAC policies, row filters, and column masks to enforce permissions at query time. Automatic Identity Management syncs users and groups from Microsoft Entra ID and Okta, while just-in-time provisioning carries current memberships into Databricks. Structured assets include tables and metric views, and governed tags can attach protection across newly tagged data; documents are governed through Unity Catalog volumes and their grants. In the Brickstore example, APAC and AMER managers ask the same question yet receive different, authorized results, with regional rows, masked email values, and shared metric definitions; the source recommends testing by impersonating users and planning volume boundaries.


### [Serving the most critical missions: Cloudflare for Government achieves FedRAMP Class D (High) Certified status](https://yomu.fyi/post/serving-the-most-critical-missions-cloudflare-for-government-achieves.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Wesley Evans
- Published: Aug 10, 2026
- Type: Announcement

Cloudflare for Government has achieved FedRAMP Class D (High) certification status, following its FedRAMP Moderate authorization in 2022 and sponsorship by the National Institute of Standards and Technology. FedRAMP High covers systems handling the nation’s most sensitive unclassified data, including law enforcement, emergency services, financial systems, and national security information, where a control breach could be catastrophic. Cloudflare says its offering runs the same software stack and services as its commercial platform on one global network, while its Data Localization Suite ensures traffic inspection and processing for FedRAMP High occur exclusively in U.S. data centers. The systems developed for FedRAMP High are also the foundation of Cloudflare’s stated pursuit of DoD Impact Level 4 authorization, with access to its Zero Trust, application performance, and developer features as they are released.


[Newer posts](https://yomu.fyi/topic/privacy.md) · [Older posts](https://yomu.fyi/topic/privacy/page/3.md)