At-source architecture
Where de-identification runs, what leaves the owner's environment, and who can access what.
De-identification runs inside the owner's environment. Raw audio, DICOM and reports never reach Quarry or the lab: only de-identified output and a hash log cross the boundary.
Where it runs
Quarry's pipeline ships as a container image or an on-prem agent and runs on the owner's own infrastructure, next to the archive. It needs read access to the source data and an outbound connection to Quarry; it opens no inbound ports. Install steps are in Installing the at-source agent.
What it does
- Reads source records in place.
- For audio: transcribes locally, detects personal data, and replaces it with a tone or silence in audio and tags in text. See audio and transcript redaction.
- For imaging: cleans DICOM headers, masks burned-in text, redacts reports and shifts dates. See DICOM and report de-identification.
- Runs automated scans on the output and prepares a sample for human QA.
- Waits for the owner's sign-off before exporting anything.
What leaves
| Crosses the boundary | Never crosses |
|---|---|
| De-identified audio, transcripts, images and reports | Raw recordings, DICOM, reports or EMR |
| A hash log: the SHA-256 of every exported file | Re-identification keys and pseudonym secrets |
| Pipeline version and run logs without personal data | Customer or patient lists |
Who can access what
| Who | Raw data | De-identified output | Hash log and run logs |
|---|---|---|---|
| Owner's staff | Yes, as today | Yes | Yes |
| Quarry staff | No | Yes, for QA and delivery | Yes |
| Lab under sample NDA | No | The sample only | No |
| Lab under licence | No | The licensed dataset | Hashes, in the manifest |
Bringing your own tooling
Where a lab or owner already runs its own at-source de-identification, Quarry verifies the output instead of running the pipeline: the same scans, the same human QA sample and the same report.