GDPR-Grade Data Anonymization for SQL Analytics

Aircloak is a data anonymization company based in Kaiserslautern, Germany, founded in 2014 in partnership with the Max Planck Institute for Software Systems. It was built for organizations holding personal data, such as health, telecom, and financial records, that want analysts to query it without triggering the full weight of data protection obligations. Its website returned no content at the time of writing, so current commercial status should be confirmed before relying on the product.

The product, Aircloak Insights, works as a transparent proxy in front of a data source. Analysts connect using ordinary SQL or a business intelligence tool such as Tableau, and the proxy answers queries through Diffix, the anonymization method developed with the Max Planck Institute. Diffix adds calibrated noise and suppresses results that would isolate a small number of individuals, so aggregate answers stay useful while single records cannot be reconstructed from the output.

Diffix went through several published iterations named Aspen, Birch, Cedar, and Dogwood, revised in part in response to public attack research; a 2019 paper demonstrated a noise-exploitation attack against an earlier version, and the attack code was published openly. The company released its Cloak query engine and Air frontend source on GitHub. Its positioning centered on GDPR, and it cited review by the French data protection authority CNIL in support of that claim.