Privacy-Safe Data Sharing with Identity Streme

Prefer a downloadable PDF version? View the PDF guide (opens in a new tab).

Historically the primary beneficiary of a data share database was a third party that managed the cooperative. With Identity Streme, FullContact enables cooperation among content creators and brands without passing sensitive information between business partners, and allows the overwhelming value of the cooperative to remain with the business partners.

With Identity Streme, you can create a multi-tenant digital data store with a collection of insights, each within a digital space with restrictions on ingress and egress, allowing data control with sensitive PII cleaned from the data flow.

Setup

We will assume you have already engaged with FullContact, that we have set up your Streme or Stremes, and that you have your API keys.

PII is cleaned upon initialization of the Streme and from all Streme operations, providing protection from data being infected by PII. This allows consumer data to remain private when working with partners.

All Stremes have a parent Streme where, at minimum, the global linkage is maintained. The parent Streme can also contain insights, and all other Stremes inherit the insights from the parent. There will be use cases where you want to restrict the insights being shared, and child Streme containers can be used for that.

Each Streme is managed by separate keys to control access. You can then choose how to share the insights with a partner brand.

Within data sharing, a common PersonID replaces all PII and is the common identifier across all of your Stremes. The PersonID is the Streme’s person identifier and does not contain any embedded intelligence that could be decoded and the individual de-identified. It is unique to your Stremes.

Brand partners have their own PersonID that is completely different from your Streme’s. The Streme maps insights you permit to the PersonID of the partner brand.

Likewise, the brand can share insight tags with you.

Initialization

You could start with an empty data share, but often you have already begun building your first-party data asset. You can initialize your data share by calling the FullContact Resolve API for the Streme. For all individuals you want to store, call the Parent Streme Resolve with the identity you know.

curl -X POST \
  https://api.fullcontact.com/v3/identity.resolve \
  -H 'Authorization: Bearer {Your API Key}' \
  -H 'Content-Type: application/json' \
  -d '{
    "emails": [
      "bart@fullcontact.com",
      "bart.lorang@fullcontact.com"
    ]
  }'

The Streme receives two email addresses, resolves them against the FullContact identity graph, and replaces them with a PersonID, which is placed in your Streme. At any point in the future you can reference the same person by either of these emails or by the PersonID.

Often you will have a large number of individuals in backend systems such as CRM, loyalty, and customer service. Although you can add people to your Streme one by one synchronously, you can also create a file extract of those individuals and use a Python recipe to bulk load your Streme through asynchronous Resolve calls.

You have now initialized your Streme with all of the individuals in your backend systems, and you have a file of them resolved to a PersonID maintained in your Streme.

Data Sharing Maintenance

Mapping Internal Identifiers

You may want to reference individuals in the data share by internal identifiers from your source systems and contributors. A RecordID should be a unique identifier that represents where the identity data is coming from. You define this. RecordIDs typically carry prefixes or suffixes identifying the source of the identity, such as a loyalty system, social platform, or CRM. You can map those identifiers into the Streme to create an association with the PersonID.

Map an internal identifier to email addresses:

curl -X POST \
  https://api.fullcontact.com/v3/identity.map \
  -H 'Authorization: Bearer {Your API Key}' \
  -H 'Content-Type: application/json' \
  -d '{
    "emails": [
      "bart@fullcontact.com",
      "bart.lorang@fullcontact.com"
    ],
    "recordId": "BonusLoyalty:A351359XT"
  }'

Map an internal identifier to a known PersonID:

curl -X POST \
  https://api.fullcontact.com/v3/identity.map \
  -H 'Authorization: Bearer {Your API Key}' \
  -H 'Content-Type: application/json' \
  -d '{
    "personId": "Hm5Oz6r4pWM7hVTjAbbodOVfttWrzjrAbwf7CBIE62uPwcqI",
    "recordId": "BonusLoyalty:A351359XT"
  }'

You can now refer to individuals in the Streme by email address, RecordID, or PersonID.

Mapping Insights

You can map any insights you hold on individuals into the Streme, either into the parent or into a child, depending on how you want to restrict sharing later.

Mapping insights uses FullContact’s Map API. FullContact provides the ability to store, manage, and extract by tags, allowing tags to be stored within your Streme for continuous updates, retrievals, and deletes across both first-party and second-party data partnerships. For each Streme you want to assign an insight tag into, call the Tag API with the API key for that Streme.

Add insight tags for loyalty tier and customer segments:

curl -X POST https://api.fullcontact.com/v3/tags.create \
  -H "Authorization: Bearer {A Parent or Child API Key}" \
  -H "Content-Type: application/json" \
  -d '{
    "recordId": "BonusLoyalty:A351359XT",
    "tags": [
      { "key" : "loyalty", "value" : "platinum" },
      { "key" : "segment", "value" : "high-spender" },
      { "key" : "segment", "value" : "luxury" }
    ]
  }'

Delete a tag:

curl -X POST https://api.fullcontact.com/v3/tags.delete \
  -H "Authorization: Bearer {A Parent or Child API Key}" \
  -H "Content-Type: application/json" \
  -d '{
    "recordId": "BonusLoyalty:A351359XT",
    "tags": [
      { "key" : "segment", "value" : "luxury" }
    ]
  }'

Retrieve insight tags:

curl -X POST https://api.fullcontact.com/v3/tags.get \
  -H "Authorization: Bearer {A Parent or Child API Key}" \
  -H "Content-Type: application/json" \
  -d '{
    "recordId": "BonusLoyalty:A351359XT"
  }'

You can also retrieve by “personId” or by “email” instead of recordId.

Sharing Insights

You are now ready to share insights with your partner brands. FullContact sets up the sharing between a partner brand and one or more of your Identity Stremes. The brand can then issue a FullContact Resolve API call to retrieve the insight tags from the permitted Stremes. The partner calls Resolve with any combination of identifiers from individuals in their systems, FullContact performs identity resolution, and determines whether those individuals are present in your Stremes. If so, the tags from the Stremes they have access to are returned.

curl -X POST \
  https://api.fullcontact.com/v3/identity.resolve \
  -H 'Authorization: Bearer {Partner API Key}' \
  -H "Content-Type: application/json" \
  -d '{
    "emails": [
      "bart@fullcontact.com"
    ],
    "phones": [
      "+13035551234"
    ]
  }'

Giving a response of:

{
  "tags": [
    { "key" : "segment", "value" : "high-spender" },
    { "key" : "loyalty", "value" : "platinum" }
  ]
}

Because you can house multiple contributing tenants within your co-op, you have considerable flexibility in how you govern data separation. You may have many contributors willing to share their insights into a common co-op Streme, and others that are only comfortable combining their insights with a select set of partners. Set up a separate Streme for those partners and map their insights into tags only in that partnership Streme.

You can always choose which brands get access to the insight tags from which Stremes, and child Stremes do not inherit insight tags from other child Stremes unless you explicitly map those insights in. That is what guarantees you do not accidentally share insights with competitors or other non-permissible entities.

Combining with Other FullContact Services

Customer Recognition

Often the insights you want to map to an individual are derived from online behavior on the contributor’s own websites. FullContact’s Customer Recognition tag lets contributors recognize authenticated and unauthenticated visitors on their sites in real time, distilled down to your Streme PersonID and stored in a cookie or localStorage. This allows contributors to align visitors into segments that can then be mapped into the Streme.

Amplification

One of the larger uses of shared insight is creating audiences that can be activated. FullContact makes this possible through the Enrich API. A brand can take insight from the tags in your data share, then call the Enrich API with those individuals, and FullContact returns hashed emails and mobile advertising IDs for onboarding into digital activation and social media platforms.

Verify Match

As the world has moved online, digital fraud has risen. Bad actors forge synthetic identities, steal identities, and perform account takeovers. Your contributors may have new account or subscriber sign-up events that need guarding against fraudulent activity, and the more validated the identity of individuals entering contributor systems, the more accurate the data in your data share. Verify Match spans both digital and terrestrial ecosystems to verify identities at sign-up, validating the contact information provided and returning a risk score that can determine whether the person should continue in the sign-up flow.

Conclusion

Through FullContact’s Identity Streme offering you can create a data share from multiple data contributors, resolve individuals from numerous distributed systems into a common PersonID, map insights from all contributors, and enable sharing of those insights with brand partners. You can set up multiple child Stremes that protect insights from leaking to competitors or other non-permissible entities, while avoiding the use of sensitive PII among co-op contributors or brands.