Querying confidential data
Development status: Being explored — The design is being explored; its public interface and support are not settled. The intention is a familiar, SQL-style way to declare and query confidential data, but confidential query execution is not available in the experimental implementation, no SQL-style interface is available to developers, and no syntax or example is published. Nothing is publicly available for live use.
Before you read: Data and state: how information is recorded and retrieved.
Will there be a familiar, SQL-style way to declare and query confidential data? That is the intention being explored. Nothing is available today: confidential query execution is not available in the experimental implementation, and no SQL-style interface is available to developers. This page describes the intended experience at concept level, explains why it shows no syntax, and lists the questions integrators should expect a future reference to answer before they could consider adopting it.
What “querying confidential data” means here
Two terms set the scope of this page:
- Confidential data — data that an application or organisation wants processed without revealing it to everyone who runs or observes the network.
- Querying — asking questions of recorded data and receiving answers.
The intention is a familiar, SQL-style way to declare which data is confidential and to query it.
This is a different capability from reading ordinary recorded data through the experimental interfaces described on Querying network data and browsing activity. Those interfaces exist experimentally for internal testing; querying confidential data is not available at all.
The intended experience
Status of this section: Being explored — the design is being explored; its public interface and support are not settled.
In the intended experience:
- an application would declare which of its data is confidential, using a familiar SQL-style form;
- it would then ask questions of that data in the same familiar style.
Teams used to SQL-style data work might find the approach familiar. No compatibility with any existing database product or query language is claimed, and a familiar style should not be read as compatibility.
How results would be returned, to whom, and with which assurances is not described. Who could see data and results is the subject of Visibility controls and selective disclosure. Performance, scale, limits and costs are not published.
What exists today
- Confidential query execution is not available in the experimental implementation.
- No SQL-style interface is available to developers.
- Confidentiality features in the experimental implementation are simulated or switched off, so it provides no confidentiality protection.
Why this page shows no syntax or example
- The design is still being explored. Publishing statements now would imply a settled interface that does not exist.
- Invented statements travel. Even a clearly invented statement could be copied, or mistaken for a released interface. For that reason, no illustrative example is planned for this topic, although other pages use clearly labelled illustrative demos as described on How illustrative examples work in this documentation.
- Syntax belongs with a release. Syntax, supported operations and examples would appear only with a supported release and its versioned reference.
Questions to expect a future reference to answer
Before adopting this capability, an integrator would need answers to questions such as these. None is answered today.
- Ownership and visibility. Which data could be declared confidential, who would own it, and who would decide who sees it? See Visibility controls and selective disclosure and Identity, keys and access: concepts.
- What stays observable. What would remain observable about queries even when data is protected? See What remains observable.
- Cost. How would costs be estimated before a query runs? See Fees and cost estimates.
- Failure. What would happen when a query cannot be answered — for example, because it is not permitted or not supported? See What can go wrong: failure and error concepts.
- Day-to-day use. How would submitting work and retrieving results feel in practice? See Submitting work and retrieving results.
How it relates to confidential computation
Querying confidential data is closely related to confidential computation — computation over encrypted data, a design goal of the project — which the experimental implementation only simulates; see Confidential computation.
The same limitation applies to both today: the experimental implementation protects no data, so neither capability is available in any protective sense. How confidential queries would be processed is not described.
Assumptions, trust and limitations
- No confidentiality, correctness, performance or availability assurance is offered, and nothing is available.
- Even once confidentiality features exist, some information about queries — such as the fact that they happen, and when — is expected to remain observable. The design acknowledges that some protocol metadata remains observable even with confidential execution, and ways to bound and reduce it are being explored.
- Nothing on this page is a commitment to a particular form, scope or release of the capability.
Not yet available, and how this page will grow
The SQL-style interface, its reference and examples are not yet available. Further technical reference is not yet available. Once released, this page would link to versioned reference and to the relevant parts of the future developer experience. The status label would change only with evidence of implementation and release.
What this page does not claim
This page does not show or describe any syntax, statement, supported operation or data model, and it states no performance or cost figure. It claims no compatibility with any database product or query language, and no confidentiality protection of any kind. Anything not stated here as available should be treated as unavailable.
Related pages
- Querying network data and browsing activity — reading ordinary recorded data through experimental interfaces.
- Confidential computation — the related capability of computing on protected data, simulated today.
- Visibility controls and selective disclosure — who would be able to see which data and results.
- Submitting work and retrieving results — the intended flow for submitting work, previewed conditionally.
- What remains observable — information about activity that is expected to stay visible.
Glossary
References
No approved public references yet.
