Case study · Government
How a national government connected its ministries to one hub that answers questions from each other’s data, now running in production.
Case study summary
Duality Technologies works with a National Digital Agency to give ministries answers from each other’s data without centralizing data and without exposing the underlying records.
The Agency hosts Duality in its own cloud environment. Ministries connect their data read-only and run encrypted queries with Secure Query, and the asking ministry receives only the answer it needs. After a successful pilot, the hub moved into production. The government operates the software and holds the encryption keys, and Duality never accesses the data.
After a successful pilot, the cross-ministry hub runs in production today.
Developed and delivered with the Agency, from public health planning to investigations.
Connected to the hub, including welfare, social security, tax, police and the prison service.
National digital agencies are asked to give citizens higher-value public services: anticipating the services people will need, delivering them in a timely way, and never asking for the same information more than once. Each of those goals depends on ministries using each other’s data, which in practice they rarely could. Government privacy also goes further than commercial data protection: it has to guard against surveillance, and against any single organization assembling a central view of its citizens.
Citizen data in welfare, health, immigration, education and law enforcement is tightly protected. Even a simple data-sharing arrangement could need extensive legal and technical approvals, sometimes taking years.
Ministries ran disconnected, mostly on-premises systems, with different data formats, integration requirements and strict CISO policies.
Each ministry had to keep control of what it shares, who can access it, and what the recipient may do with it.
Secure data collaboration lets one organization get an answer from data held by another party, without that party handing the data over. At the Agency, every check follows the same four steps.
Each ministry keeps its data in its own secure environment and connects it read-only from its existing systems.
The asking ministry’s question is encrypted. Only the requester can read the question and the result.
On the Agency’s hub, Duality combines post-quantum FHE and TEEs to protect data throughout processing.
The approved answer goes to the agreed recipient. Every run is approved in advance and recorded in an audit trail.
Every check follows the same path. Here, welfare services asks the police and the tax authority about a household before a home visit. The question stays encrypted, each answering ministry keeps its records in its own secure environment, and only the answer goes back.
Fully homomorphic encryption (FHE) computes on data while it stays encrypted. Trusted execution environments (TEEs) are hardware-isolated enclaves that protect data while it is processed. Duality chooses the technologies that suit each workload, individually or in combination. When a transfer is necessary, only the relevant records are shared, which reduces approval requirements.
Read more about computing on encrypted data with FHE, confidential computing with TEEs and encrypted queries across organizations.
Government departments analyze data together without pooling it. Each department keeps its records, and only the agreed results are shared.
Agencies query each other’s datasets without disclosing what they are looking for. The question stays encrypted, and only the answer comes back.
Explored and delivered with the Agency during the engagement.
Combine health and social data to plan services for at-risk populations.
Find citizens eligible for support but not receiving it, without merging registries.
Answer eligibility questions between ministries, so citizens are not asked again.
Check claims against other ministries’ records to detect error and fraud.
Measure a policy’s outcomes across education, employment and welfare data.
Run governed queries across agency datasets without revealing the subject of the inquiry.
A sample of the checks running on the Agency’s platform today. In each, the question itself could reveal too much.
| Asking ministry | The check | Answering ministry | What stays hidden |
|---|---|---|---|
| Welfare services | Before a home visit: are there relevant police or tax records for this household? | Police, tax authority | That a welfare visit is planned, and for whom |
| Prison service | Is this person already known to welfare services? | Welfare services | The person’s incarceration status |
| Welfare services | Which of our highest-need clients are recent arrivals, for priority support? | Population and immigration authority | Which clients welfare considers highest-need |
| Social security | Does this claimant’s reported income match tax records? | Tax authority | That the person has claimed a benefit |
Each check returns only the answer it needs. The question, and the context behind it, stay encrypted.
What the privacy regulator and ministry data protection officers required, and how the architecture answers it.
| Principle | What it means across ministries | How it is enforced |
|---|---|---|
| Minimization | Only the identifiers and fields a check needs are used, and only the answer leaves. | Each approved computation fixes its inputs and outputs |
| Confidentiality | The answering ministry never learns who is being asked about, or why. | Encrypted queries: only the requester can read the question and the result |
| Security | Records are not exposed or copied between ministries. | FHE and TEEs protect data in use; post-quantum encryption |
| Sovereignty | Each ministry keeps control of its data, keys and analyses. | Customer-managed software, government-held keys, attestation before key release |
| Ease of use | Fits each ministry’s current tools, dashboards and legacy systems. | UI, API and SDK, including Python; no cryptography expertise needed |
| Governance | The data owner decides what is shared, who receives it and what they may do with it. | Policy enforced on every computation, approved before it runs |
| Auditing | Every analysis and every result can be accounted for. | Full audit trail of each run across the collaboration |
Proportionate security and governance let data owners, the privacy regulator and data protection officers sign off on the workflow itself, instead of a separate exception for every collaboration. All participants agree to each computation before it runs, with policies enforced and every action recorded in an audit trail. That framework gave each ministry the assurance it needed to authorize its participation.
Post-quantum encryption protects data at rest, in transit and in use, and Duality Technologies is ISO 27001 certified. This control model is what the AI Sovereignty framework calls Cryptographic and Computational Sovereignty, and it is what lets ministries collaborate without surrendering control.
Duality is hosted in the Agency’s own cloud environment, as customer-managed software inside the government’s security perimeter.
Ministries connect existing data sources and formats read-only. No ministry rebuilds its data architecture.
Encryption keys are government-held and released only after attestation confirms the computing environment. Duality never accesses the data.
How the engagement moved from mapping the first use cases to a live cross-ministry hub.
Phase 1
Joint mapping of cross-ministry use cases and of the legal, technical and organizational barriers to sharing.
Phase 2
First encrypted queries between ministries on real data, then a governance model reviewed with privacy and legal stakeholders.
Live
The pilot became a production deployment: customer-managed software, government-held keys.
Ongoing
More ministries and use cases onboarded onto the Agency’s cross-ministry hub.
Choosing the privacy technology was the first step. What made it work between ministries was the governance and operational framework around it. Duality Technologies provides that layer, so each ministry’s effort goes into the service, not the machinery around it.
Who takes part, under which agreement.
What each computation may touch.
Who holds them, and when they are released.
Who receives which answer.
Agreed before every run, recorded after.
The same controls across every ministry, system and policy.
Yes. Each ministry keeps its data in its own environment and connects it read-only. Other ministries send encrypted queries and receive only the answer they need, not the underlying records.
No. The query is encrypted, so the answering ministry doesn’t learn who the question is about or why. Only the asking ministry can read the question and the result.
No. Duality ships customer-managed software. At the Agency, the government operates it and holds the encryption keys, and Duality never accesses the data.
No. You connect existing data sources read-only, in their current formats, and work through a UI, an API or an SDK, including Python. No cryptography expertise is needed.
At the Agency, post-quantum fully homomorphic encryption (FHE) and trusted execution environments (TEEs). Across the platform, Duality also supports federated learning and differential privacy, chosen per workload.
Read about cross-department analytics in government, or the cross-border pediatric cancer research pilot with NHS England, the National Cancer Institute and DSIT. Client identity in this case study is withheld under confidentiality; all use cases, architecture and outcomes reflect a live engagement.
See how your ministries could get answers from each other’s data without sharing the records. Start with one use case.