A supplier you already work with wants to measure their own performance in your stores. This page describes exactly what that involves on your side. It is written for you and your counsel, not for them. The short version: your transaction records are never readable by anyone but code you approved — not by the supplier, not by the cloud operator, not by us — and you approve every analysis before it can run.
The mechanism
Your loyalty transactions and the supplier's campaign file are each loaded into a hardware-sealed enclave — a region of a processor whose memory is encrypted and whose contents are unreadable to the operating system, to the cloud provider, to the supplier, and to us.
Decryption keys are released to that enclave only after the hardware proves, cryptographically, that the code about to run is the exact code you approved. Different code, even by one byte, and the keys are not released. This is not a contractual promise about who will look. There is no mode in which anyone looks.
Only aggregates come out. Rows about identifiable households do not exist in readable form anywhere outside the enclave at any point.
You produce an export and encrypt it with a key you generate and hold. The encrypted file moves; the readable data does not. Ciphertext travels to wherever the enclave runs, and it is useless there to anyone without the key — including to us, to the cloud operator, and to the supplier. The key is released to the enclave by the attestation service only after the processor proves which code and configuration are loaded. The plaintext then exists only inside encrypted processor memory for the duration of the run, and is gone when it ends. So the accurate sentence is not “your data never moves” — it is your data never becomes readable to anyone, anywhere, at any point, including while it is in motion and including on the machine where the analysis happens.
You do. Three configurations, all the same software: in your own cloud account, on hardware you pay for and can switch off — this is the one most retailers choose, and in it the ciphertext never leaves your tenancy; in a neutral account neither side controls, with both parties on the attestation policy; or in ours. The attestation evidence is identical in all three, which is the point — you are not trusting the operator of the machine, so who operates it is a commercial question rather than a security one.
The encrypted export, for as long as you keep it — you hold the only key. A decrypted copy inside enclave memory, which is encrypted by the processor against the host and destroyed when the run ends. The aggregate output, which both sides keep. There is no fourth copy. Nothing is cached between runs, nothing is retained for a model, and if you destroy the key, every export encrypted under it is permanently unreadable, including any copy anyone else is holding.
A compromise of your own systems before the export is made. A flaw in the processor vendor’s implementation — TEEs have had published vulnerabilities and will have more, which is why the measurement and the vendor’s patch level are both in every manifest. And inference from the aggregates themselves, which no amount of encryption addresses and which is why the cell minimum and the query allowance exist as separate controls.
Keys are released only to code you approved. Different code, even by one byte, and your data stays encrypted. This is not a contractual promise about who will look — there is no mode in which anyone looks.
Plainly
The part to read twice
The supplier never receives identifiers. An activation destination is a different question, and it is the one worth your attention, because the three tiers are not equivalent and we are not going to present them as though they were.
We show the difference rather than hiding it behind one identical button. Hiding it is how you lose a retailer — usually at the contract stage, after everyone has spent three months.
Onsite display, email, in-store offers. The audience never leaves your perimeter: it exists there as a key against your own loyalty IDs. Nothing crosses any wire. This is the default and it covers most campaigns.
Matching runs inside the enclave. What crosses is the DSP's own device and account identifiers, for households it already had in its graph. Your identifiers do not cross, and the DSP learns nothing about households it did not already know.
Stated plainly: these platforms match on hashed email and phone, so that is what they receive, and they resolve it to their own user IDs. This is a real disclosure to them about which of your customers are in the audience. It is not something encryption solves, and nobody who tells you otherwise is describing how these platforms work.
What our architecture does change: no file is created, nothing is exported, no analyst touches a list, and the enclave sends it using your platform credentials rather than ours, so you are the sender of record. And Tier C requires a separate signature from you, per destination, recorded in the run manifest. If you never sign it, the enclave is technically incapable of reaching those platforms at all.
Your controls
There is no open query console. Each analysis is a fixed, reviewed template with a published fingerprint. You see what it computes before you sign it, and only signed templates can obtain keys.
Minimum cell size, minimum segment size, which fields may appear in output. These live in a policy you sign, not in our settings panel. We cannot change them without your signature.
Thresholds protect any single query. They do not protect against a long series of individually harmless ones — which matters more each quarter, as AI agents begin asking the questions instead of analysts. Every requester has a disclosure budget, and you can see how much of it has been spent, by whom, against which dataset.
Withdrawing approval stops future runs at once. There is no copy of your data elsewhere to retrieve, because none was ever made.
Why bother
Suppliers who can measure what happens in your stores shift budget toward your stores. That is the direct effect, and it lands in your retail media revenue rather than in a line item you have to invoice for.
The indirect effect matters more. Today a mid-sized grocer who wants to be measurable has one realistic route: an intermediary that sees every retailer at once, including what your customers buy from your competitors, and that competes with you for the customer relationship. This is the other route. Your data stays yours, your supplier gets what they need, and no third party acquires a view across the market by sitting in the middle of it.
Nothing for the first supplier engagement. The brand pays the setup fee and the per-analysis fee; we do the schema mapping, the product hierarchy and the identifier work. Your cost is a data export and a technical contact who can answer questions about your own schema. Once more than one supplier is running against your data we move you to a platform fee, and by that point it is your infrastructure rather than a favour you are doing someone.
When an audience built from your data is activated outside your own media, you are in a position to charge an audience fee for it, as larger retailers already do — because the audience does not move without your signature and cannot be reconstructed anywhere else. We take no position in media, buy none, and mark none up. What you charge is between you and the supplier.
Your own copy of every run involving your data, with the same manifest the supplier receives. Plus a category view no individual supplier sees: who is growing in your stores at whose expense, which suppliers are measuring and which are not, and where demand exists that nobody is serving. That report is yours and is not visible to any brand.
You do, explicitly, as a separate permission from basic measurement — because switching analysis tells one supplier something about another supplier's performance in your stores. The convention we propose is reciprocity: a brand that can see switching in a category is itself visible in that category's switching to other participants, at the same aggregation. You can also withhold it entirely, and every template still runs without those columns.
Questions counsel usually asks
Neither. No data is transferred to the supplier or to us, and no copy is created. What is granted is permission for a specific, named computation to run against data that remains in your control, producing aggregate output. Your counsel will want the data processing agreement; we provide a template with an appendix describing the attestation and the thresholds. How long your review takes is your decision and we are not going to put a number on it — what we control is giving your counsel a short document and answering questions directly rather than through a sales channel.
One exception to be precise about: Tier C activation is a disclosure to the receiving platform, and your counsel should treat it as a separate decision with its own signature, not as part of the measurement agreement.
Every run produces a signed manifest: which code ran, against which datasets, under which policy version, in which enclave, producing which output — each identified by cryptographic hash, with the hardware's own signature attached. The enclave quote validates against the processor vendor's attestation service, operated by the chip maker and not by us. If we claimed something false, it would not check out.
You do not have to take that on description. A sample package and the full checking procedure are published here, with real file hashes your team can recompute in a terminal, and a plain list of what the sample cannot prove.
We cannot produce what we cannot read. We hold no decryption keys for your data; key release is governed by a policy you control and executed by the hardware against the code fingerprint. Compelling us yields ciphertext.
An export and a technical contact for questions about your schema. The mapping, the identifier resolution and the running are ours. The first engagement is scoped at six weeks end to end, and most of that is paperwork and data preparation rather than anything your team does.
No. Each supplier's arrangement is separate, approved separately by you, and isolated at the hardware level. One supplier cannot observe another's queries or results, and neither can we.
Who we are
Lift Mosaic is built by the team behind Aggregion — a data collaboration platform used by Disney, P&G, PepsiCo and Pearson, acquired in 2022. In 2020 it shipped a confidential multi-party data analysis service together with Microsoft and Intel, with a major grocery chain piloting multi-party confidential analysis on it. We have run this kind of arrangement before, with retailers who asked the same questions you are about to ask.
The trust layer underneath is hardware attestation on Intel TDX and AMD SEV-SNP: production technology, in use in regulated industries today, not a research demonstration.
Questions, including the uncomfortable ones — book 30 minutes. We would rather answer them now than at the contract stage.
Lift Mosaic. This page describes the arrangement in plain terms and is not itself a contract; the data processing agreement and the signed policy govern. Figures and thresholds quoted here are defaults and are set per engagement by the data owner.