We pool the road, never the driver

When a member pushes an observation, the exchange records one thing: a coarsened speed or incident state on a canonical road segment. It is not a location of a person; it is a property of a piece of asphalt at a moment. The underlying journey — where a driver came from, where they are going — never enters the system, because the protocol has no field for it and rejects requests that try to supply one.

AnTIE accepts single, coarsened speed samples and verdicts, not tracks. Any payload containing what looks like a device id, phone number, vehicle plate, or an array of sequential points that would constitute a trajectory is refused with a 400 at the validation boundary — not discouraged later in a policy, blocked at the schema. The engine simply cannot ingest a path, so it can never leak one.

Each sample is tagged to a member and a rotating per-member pseudonym, never to a person. The salt is per-member and time-windowed, so a contributor’s reports are unlinkable across members and across windows. No verifier — including another member — can tie two observations to the same driver, and the hub itself cannot re-identify one even if compelled, because it was never given a key to.

A segment only ever publishes an aggregate consensus once enough independent samples clear a k-anonymity floor. Below that floor the segment reads unknown — never a guessed colour, never a sparse reading that could single out the one car on that road. Thin evidence is designed to collapse to silence, which is simultaneously a data-quality rule and a privacy rule.

The reference implementation and any production instance are Malaysia-hosted and structured to satisfy the PDPA by construction rather than by clause: no identities are collected, so there is no personal data to process, and no cross-member join key exists, so there is no profile to disclose. Where the law asks for purpose limitation and minimisation, the architecture answers it before a policy has to.

During chartering and the first two-app pilot, participating companies, fleets and agencies — and any early contribution or coverage figures — are named only with their consent. Corridor sets and pooled results are reported without identifying any organisation or individual that has not agreed to be named. Anonymity for the founding cohort is a rule of the exchange, not a courtesy.

To ask how any field above is enforced in code, or to raise anything about the data the exchange handles, write to antie@antrex.app or use the Antrex contact desk at antrex.app/contact.