Zero-PII architecture

A zero-PII architecture is a system design in which no plaintext personal identifiers exist in storage: identifiers are keyed digests, operational personal data is encrypted with purpose-bound access, and the property holds structurally rather than by policy. The test is the breach counterfactual: a full database exfiltration should yield no personal data an attacker can read or reverse.

The word that carries the weight is structurally. A policy that says identifiers are hashed can be true of the code written yesterday and false of the endpoint added this morning; a structural property is one where the write path cannot express the unsafe version.

The counterfactual is the only honest test, and it is worth running against a real dump rather than a description: take the columns a breach would yield and ask which of them a determined reader could turn back into a person.

The structural version of the property is enforced by the write path rather than by review. If the only way to persist an identifier is through a function that hashes it, then an endpoint written this morning inherits the property; if the rule lives in a document, the endpoint inherits whatever its author remembered. Gates that read the code and fail the build are the mechanism that makes the distinction real.

Logs are the surface where the property most often breaks, because logging is added under pressure during an incident and rarely reviewed afterwards. An identifier interpolated into a log line is stored in the clear in a system that usually has broader access and longer retention than the database, which inverts the protection the architecture was built for.

Running the counterfactual against a real dump rather than a description is the only honest test. Take the columns an exfiltration would yield and ask which of them a determined reader could turn back into a person, remembering that an unkeyed digest of an enumerable identifier is not one of the safe ones, as keyspace enumeration makes concrete. What survives that question is the architecture; what does not is a policy with a diagram.

The write-path discipline that makes it structural is keyed hashing for identifiers and purpose-bound encryption for anything that must stay reversible.