Pre-Deal Copilot · data privacy
Aggregable vs private — exactly what's shared, by whom, when
OilFlow's compliance-tech moat depends on a corpus that compounds. But banks rightly object to their deal-flow leaking into a competitor's precedent stream. This page documents the partitioning model in full, so your MLRO + your IT security + your procurement team can sign off without a 90-day audit.
The model
Every row in the predeal_checks ledger carries a data_class column with one of two values:
- aggregable — visible to OilFlow's cross-customer reader paths. Powers precedent counts, peer-bank insight, counterparty pulse, defense-pack peer context. Default for Solo + Desk.
- private — visible only to the originating member's own queries. Excluded from every cross-customer aggregation. Default for Bank Enterprise.
Per-request override
Any verdict request can override the tier default by sending the X-OilFlow-Data-Class header:
POST /api/v1/predeal/check
curl -X POST https://oilflow.us/api/v1/predeal/check \
-H "Authorization: Bearer $OILFLOW_API_KEY" \
-H "X-OilFlow-Data-Class: private" \
-H "Content-Type: application/json" \
-d '{
"counterparty": "Acme Trading Co",
"origin": "AE",
"destination": "PK",
"commodity": "EN590"
}'Example request — the X-OilFlow-Data-Class header overrides the tier default for this row only
Bank Enterprise customers can flip a single deal to aggregable for any deal they're comfortable contributing to the corpus. Solo / Desk customers can flip a single deal to private for any deal they don't want surfacing in cross-customer aggregations.
Tier defaults
| Tier | Default | Reason |
|---|---|---|
| Pre-Deal Solo ($99/mo) | aggregable | Individual RMs benefit from the cross-customer pulse + precedent library. Their verdicts contribute to the same corpus they read. |
| Pre-Deal Solo Founding ($699/yr) | aggregable | Same as Solo monthly — founding-customer status is a price-lock, not a data-class change. |
| Pre-Deal Desk ($999/mo) | aggregable | Commodity-house desks also benefit from the cross-customer aggregations. Override per-request if you want a single deal kept private. |
| Pre-Deal Bank Enterprise | private | Bank Enterprise contracts default to private: only your members see your rows. Removes the corpus-rights friction that blocks compliance sign-off on enterprise deployments. |
Reader paths that respect the partition
Every cross-customer reader runs the same SQL gate: WHERE data_class = 'aggregable'. The list below enumerates every path that hits the partition. If a path is missing from this list, it does not read cross-customer rows.
| Endpoint / daemon | Filter behavior |
|---|---|
| /api/v1/predeal/check (peer-bank insight) | Filters data_class='aggregable' before computing peer-bank precedent counts. |
| /api/v1/predeal/precedents | Filters data_class='aggregable' across the precedent corpus search. |
| /api/v1/predeal/pulse/[entity] | Filters data_class='aggregable' on the counterparty pulse aggregation. |
| /api/v1/defense/generate (peer context) | Filters data_class='aggregable' on the 180-day peer-context window for defense-pack narratives. |
| counterparty_intel daily brief daemon | Filters data_class='aggregable' when generating delta-detection briefs. |
Paths that ignore the partition (self-visibility)
The partition controls cross-customer visibility, not self-visibility. The following paths always return the requesting member's own rows regardless of the row's data_class:
| Endpoint | Behavior |
|---|---|
| /api/v1/predeal/history (personal history) | Always returns the requesting member's own rows regardless of data_class. The partition is about cross-customer visibility, not self-visibility. |
| Outcome-marking endpoints (KYC escalation, deal abandonment) | Outcome telemetry runs against all of a member's own rows. Required for SKU #7 efficacy honesty. |
The migration that enforces this
The data_class column was added by migration 165 (165_predeal_checks_data_class.sql). Every cross-customer reader path was updated in the same commit to filter the partition. CI guards (scripts/audit_drift.py) fail the build if any new reader path is added without the filter.
For your procurement / MLRO / IT security review
The full data-flow diagram + retention schedule + cryptographic-binding spec for defense packs lives at /products/defense-ledger/verification. Bank Enterprise contracts include a customer-specific addendum naming the data-class default and any negotiated cross-customer carve-outs.
If you need a signed copy of this page (date + hash) for your audit file, email [email protected].