The Trust Problem in Civic Technology
Every civic technology platform faces the same fundamental challenge: getting people to share honest, vulnerable perspectives about issues that matter to them — and trusting that those perspectives won't be used against them.
This isn't hypothetical. People have legitimate reasons to distrust systems that collect their political and social views:
- ◇Employers who monitor social media and penalize employees for public positions
- ◇Neighbors who retaliate against people who speak against popular local projects
- ◇Government agencies that could use detailed opinion data for targeted enforcement
- ◇Data brokers who could correlate civic participation data with commercial profiles
Traditional civic tech platforms address this with privacy policies — legal documents that promise not to misuse data. But a privacy policy is a promise, and promises can be broken, revised, or overridden by court order.
Architecture vs. Policy
The alternative is privacy by architecture: designing the system so that it holds as little as possible, and so that misuse is structurally hard rather than just contractually prohibited.
This is the difference between a bank that promises not to lose your valuables (policy) and a bank that never takes custody of them in the first place (architecture). Both matter, but the data you never collect can't be leaked, subpoenaed, or repurposed.
The Four-Layer Model
The Civic Filament uses a four-layer privacy architecture, designed to minimize what is collected and what can be traced back to you:
Layer 1 — Interview. Your conversation with the AI mediator is not stored on our server. The transcript stays in your browser and is automatically deleted after 30 days. It passes through our server only to reach Anthropic's API, so the mediator can reply and, at the end, extract a summary. Anthropic does not train its models on API data.
Layer 2 — Redaction. Before text reaches the AI or storage, pattern-based redaction strips email addresses, phone numbers, SSN-style numbers, card numbers, street addresses, and URLs. Pattern matching can't reliably detect names, so we ask participants not to share them — this layer reduces risk; it doesn't eliminate it.
Layer 3 — Summary. What the server keeps is an extracted summary: your position, stance, values, needs, conditions, engagement depth, and a heuristic quality score. It's linked to a SHA-256 hash of a random anonymous session ID — and to an account ID only if you choose to sign in. Synthesis works from these summaries: Claude rates each on 16 named value dimensions, and those profiles are clustered to find where values align, where conditions unlock agreement, and where genuine divergence exists.
Layer 4 — Output. The Living Requirement Document reports aggregate patterns. No synthesis is published until at least 10 perspectives exist, and no statement is published unless at least 5 participants support it — thresholds designed to make it harder to single anyone out. Each synthesis version also publishes a Merkle root, and you get a receipt you can use to verify in your browser that your perspective was included.
What This Doesn't Do
We want to be precise about the limits. Civic Filament does not use differential privacy, and there is no formal, provable guarantee that someone can't infer anything about an individual from the output. The thresholds above lower the risk of small-group identification; they don't make it impossible. A summary could still contain details that identify you if you share them in conversation, and signing in links your summary to your account. The Merkle receipts prove what a published version was computed from — on their own they don't prove nothing was dropped before publication, which is exactly why receipts sit with participants, who can check.
Why This Matters for Adoption
Civic technology adoption is fundamentally a trust problem. People won't share honest perspectives about sensitive issues — policing, housing, school policy — if they fear that their input could be identified and used against them.
Privacy-by-design addresses this at the architectural level:
- ◇Less to expose. A government employee can share their perspective on a policy they publicly support but privately oppose. With no stored transcript and no required account, there is far less that could tie that view back to them.
- ◇Less social pressure. In tight-knit communities, people can share views that differ from their neighbor's without their words being published under their name.
- ◇Control over your contribution. You can withdraw your perspective from future synthesis runs, or delete your data from both our server and your browser.
What We Don't Offer (Yet)
Self-hosting isn't available today — the code lives in a private repository and isn't open source. That means you do have to trust how we operate the service, and we'd rather say so plainly than imply otherwise.
The "who controls the AI?" concern rightfully makes many communities skeptical of civic tech platforms operated by private companies. Our answer for now is to hold as little as possible and to publish the rules the mediator follows.
Privacy as Competitive Advantage
In a market where many civic tech platforms collect user data and promise to handle it responsibly, privacy-by-design is a structural advantage. It's not just better marketing — it's a different trust proposition.
Architecture doesn't eliminate the need to trust us. It shrinks it.
And the data we never keep can't be misused.