Back to launch page

Trust

How the system works, end to end

From contributor consent to a de-identified, licensable delivery — the live amina → BantuNomics pipeline that produces everything this site sells.

Every recording BantuNomics licenses travels the same governed path. Consent is the gate the pipeline is built around, de-identification is enforced at the boundary, and the licensable set is maintained live — a contributor who withdraws drops out automatically. This page documents that path with the platform's current live numbers.

1. Consent (amina.ai)

A contributor signs up for one country+language, accepts the all-or-nothing v2.0 consent instrument, and a per-consent audit record is stored (version, timestamp, IP, user-agent, scope grants). Consent is per-language — see Provenance & consent for the full instrument and audit schema.

2. Record + acoustic QC

Recordings are 48 kHz mono WAV; each take passes an acoustic quality check. Rejected takes are excluded from everything downstream — they never count toward a licensable speaker.

3. The publishable-speaker pipeline (the keystone)

The collection abs_public_speakers is the single source of truth for who is licensable. It is derived live from the facts above — a (speaker, language) is active only when every gate passes:

Approved	operator-vetted contributor account (not auto-authorized)
Consent	per-language v2.0 research_consent granted AND not revoked
Quality	acoustic quality pass; rejected takes excluded
Age	contributor confirmed 18 or older
Live	tombstone-only (revoke/delete → status=removed); circuit-broken refresh

The pipeline is tombstone-only: a contributor who revokes consent or is deleted is marked status=removed (never hard-deleted), and a circuit-breaker aborts any run that would remove an unexpected number of speakers. This site reads active speakers only, so withdrawal takes effect everywhere — coverage, the player, and the API — with no manual step.

4. De-identification at the boundary

Only an allowlist of coarse, anonymized fields ever crosses to a customer. public_id (e.g. BEM-A04) is the only identity; the internal user_id is read server-side to fetch the right audio and is never sent.

A build-time regression test fails the release if any forbidden identifier appears in a response — see the roster of real, consented voices on Speakers.

5. Serving + the API (this app)

The comparison player, Coverage, and the entitlement-gated FSI Customer API all read active speakers only. Audio is streamed through opaque signed tokens — the raw GCS path is never exposed; tamper with the token or pass a path and the request returns 404.

6. Delivery + the licensing chain

Each licensed delivery emits a manifest — which public_ids, which consent versions, the gate criteria, the date — persisted as the auditable rights-chain record. The consent scope and the per-language key travel with the data, so the chain from paid, consented contributor to licensee is provable end to end. Details: Security · Provenance.

Diligence questions: partnerships@bantunomics.com.