# Privacy-preserving eligibility: why the record should never leave your host

> The question is small. The file is not. Privacy-preserving eligibility keeps the record on your side and returns only the answer.

- URL: https://www.affix-io.com/blog/privacy-preserving-eligibility-record-never-leaves-host/
- Published: 2026-08-28
- Section: Privacy
- Keywords: privacy preserving eligibility, data minimisation verification, local prove eligibility, PII minimisation

## Summary
Eligibility checks fail privacy when the whole record travels to a vendor. Privacy-preserving design proves the question on the host that already holds the data.

## FAQ
Q: What does privacy-preserving eligibility mean in practice?
A: The system that already holds the customer record runs the check locally. The outside world receives a signed yes or no (or a narrow attribute), not a copy of the underlying file.

Q: Is this the same as anonymisation?
A: No. Anonymisation tries to strip identifiers from a copy. Privacy-preserving eligibility avoids creating the copy in the first place.

Q: Can regulators accept a yes/no without seeing the source record?
A: They accept outcomes every day in credit, employment, and licensing. What they ask for is traceability: method, timestamp, and integrity of the decision.

Q: Does the verifier see personal data?
A: Not if you design for minimisation. The verifier checks a signature on an outcome, not a dossier.

## Internal links
- https://www.affix-io.com/product/
- https://www.affix-io.com/security/
- https://www.affix-io.com/how-it-works/

AffixIO blog. Human-authored. United Kingdom.