Pre-Deal Copilot · data privacy
Aggregable vs private: exactly what's shared, by whom, when
OilFlow's compliance-tech moat depends on a corpus that compounds. But banks rightly object to their deal-flow leaking into a competitor's precedent stream. This page documents the partitioning model in full, so your MLRO + your IT security + your procurement team can sign off without a 90-day audit.
The model
Every row in the predeal_checks ledger carries a data_class column with one of two values:
- aggregable: visible to OilFlow's cross-customer reader paths. Powers precedent counts, peer-bank insight, counterparty pulse, defense-pack peer context. Default for a keyed request that sends no data-class header.
- private: visible only to the originating member's own queries. Excluded from every cross-customer aggregation. Default for a scoped deployment, and forced for the free public check and for internal QA.
Per-request override
Any verdict request can override the account default by sending the X-OilFlow-Data-Class header:
POST /api/v1/predeal/check
curl -X POST https://oilflow.us/api/v1/predeal/check \
-H "Authorization: Bearer $OILFLOW_API_KEY" \
-H "X-OilFlow-Data-Class: private" \
-H "Content-Type: application/json" \
-d '{
"counterparty": "Acme Trading Co",
"origin": "AE",
"destination": "PK",
"commodity": "EN590"
}'Example request: the X-OilFlow-Data-Class header overrides the account default for this row only
A scoped deployment can flip a single deal to aggregable for any deal it is comfortable contributing to the corpus. Any other keyed customer can flip a single deal to private for any deal they don't want surfacing in cross-customer aggregations. The header wins over the account default in both directions.
Defaults by request path
| Request path | Default | Reason |
|---|---|---|
| Free live check at /predeal | private | The public check runs with no account on channel web_demo, and the handler forces those rows to private. Nothing you type into the free check reaches a cross-customer read. |
| Keyed request with no data-class header | aggregable | A keyed request that omits X-OilFlow-Data-Class takes the column default, aggregable, so its verdict contributes to the same corpus it reads. Send the header to keep one deal out. |
| Scoped bank or insurer deployment | private | Scoped deployments are provisioned on an enterprise tier string, and the handler defaults those rows to private: only your own members see them. The data class and any cross-customer carve-out are written into the contract, which we scope on a call. |
There is no monthly subscription tier behind this column any more. What you can order today is the Counterparty Screen at $95, machine output on one named counterparty inside the hour, or the Counterparty File at $500, the same steps plus a named human's written judgement and signature by the end of the third business day. Both are ordered by email to [email protected] and an invoice comes back; the terms are on /pricing. The live check at /predeal stays free. Both delivered products ship marked DRAFT for review by independent legal counsel, PEP is not screened and adverse media is not swept.
Order on one named counterparty
Counterparty Screen$95
One name, delivered within the hour, marked DRAFT for review by independent legal counsel, no human read. PEP is not screened; adverse media is not swept.
Email [email protected] with the product and the counterparty name in the subject. An invoice comes back by reply. Both are prepaid by invoice or marketplace order; there is no card checkout.
Reader paths that respect the partition
Every cross-customer reader runs the same SQL gate: WHERE data_class = 'aggregable'. The list below enumerates every path that hits the partition. If a path is missing from this list, it does not read cross-customer rows.
| Endpoint / daemon | Filter behavior |
|---|---|
| /api/v1/predeal/check (peer-bank insight) | Filters data_class='aggregable' before computing peer-bank precedent counts. |
| /api/v1/predeal/precedents | Filters data_class='aggregable' across the precedent corpus search. |
| /api/v1/predeal/pulse/[entity] | Filters data_class='aggregable' on the counterparty pulse aggregation. |
| /api/v1/defense/generate (peer context) | Filters data_class='aggregable' on the 180-day peer-context window for defense-pack narratives. |
| counterparty_intel daily brief daemon | Filters data_class='aggregable' when generating delta-detection briefs. |
Paths that ignore the partition (self-visibility)
The partition controls cross-customer visibility, not self-visibility. The following paths always return the requesting member's own rows regardless of the row's data_class:
| Endpoint | Behavior |
|---|---|
| /api/v1/predeal/history (personal history) | Always returns the requesting member's own rows regardless of data_class. The partition is about cross-customer visibility, not self-visibility. |
| Outcome-marking endpoints (KYC escalation, deal abandonment) | Outcome telemetry runs against all of a member's own rows. Required for SKU #7 efficacy honesty. |
The migration that enforces this
The data_class column was added by migration 165 (165_predeal_checks_data_class.sql). Every cross-customer reader path was updated in the same commit to filter the partition. CI guards (scripts/audit_drift.py) fail the build if any new reader path is added without the filter.
For your procurement / MLRO / IT security review
The full data-flow diagram + retention schedule + cryptographic-binding spec for defense packs lives at /products/defense-ledger/verification. A scoped bank or insurer deployment includes a customer-specific addendum naming the data-class default and any negotiated cross-customer carve-outs. Rollouts and API access carry no list price; we scope them on a call, and the intake is /apply.
If you need a signed copy of this page (date + hash) for your audit file, email [email protected].