Decentriq · data clean rooms for AI

From a specialist's tool to an enterprise data-collaboration platform.

Banks, insurers, and hospitals need to collaborate on sensitive data to unlock AI insights, without ever exposing it.

Role
Head of Product Design, Design Manager
Team
1 designer I managed, 6 developers, me
Timeline
~14 months, with the design system built alongside new features
Research
User testing with media and data teams at client companies
50%
less development time
75%
product adoption growth in 1 year
In short
Problem
A fragmented, highly technical experience stalled the sales cycle for non-technical buyers and capped growth in the MarTech ecosystem.
My role
As Head of Product Design, I led the redesign and owned the token-based design system, which I built on top of an open-source system: built and shipped with one developer in four months, then rolled out across the platform over six.
Key decision for the redesign
Make the privacy legible: every result labelled as aggregate-only and every step showing what stays inside the enclave, so a non-technical team could trust a product it couldn't see into.
Outcome
50% less development time from the new system and 75% product adoption growth in one year.
app.decentriq.com/insightsLive prototype
Decentriq insights screen
Two companies see exactly where their audiences overlap, and the affinity between them, without either side ever exposing a single row of data.
The problem

A privacy platform only specialists could use.

The technology stayed the same; the audience changed. Buyers were now MarTech teams, often media managers, and a fragmented, highly technical experience was stalling their sales cycle.

app.decentriq.com/data-clean-room
A clean room end to end: provision, request, approve, return insights. Neither side ever sees the other's rows.
Journey maps

Two seats, two very different journeys.

I mapped both sides of the same collaboration. One person was guessing at words nobody had taught her. The other was signing off a step he could not undo.

Both journeys bottom out just before the result: Sara in three silent days of waiting, Marco handing over data he can't take back. That is where the design work went.

User research

Interviews and usability testing kept surfacing three needs:

Decentriq user testing sessions: participants moving through the redesigned audience flows on a recorded call
Testing the redesigned flows with media and data teams, in the room and remote.
The decision

Make privacy legible.

Nothing in the product was unsafe. Users just had no way to verify that it was safe. The research said what they needed to see: how their data was processed, feedback while it happened, and the privacy thresholds that protected them. The journey maps said when: during Sara's silent wait and Marco's irreversible hand-over. So I designed the guarantee into the interface at exactly those moments.

The safety had to be visible, not just true.

What we tried first
Exploration 01
Illustration: a trust page explained once, separate from the upload screen

Explain it once. A trust page and onboarding tour covering the enclave, encryption and thresholds. People read it and moved on. In testing they still asked "can they see my data?" at the upload step, two screens after the answer. We tested it with six media managers. Five of them asked the question anyway.

Exploration 02
Illustration: stacked confirmation dialogs before each action

Confirm everything. A dialog before every sensitive action, restating the guarantees. Safe, but by the third dialog testers clicked through without reading, and the one irreversible step looked like all the others. A clickable prototype, tested with four publisher data leads. Average time on the third dialog was under two seconds.

Shipped
Illustration: the upload screen showing each encryption step and what the partner will see

Answer it on the upload screen. The privacy promise appears right where people worry about it. As the file uploads, each protection ticks off, and a panel spells out what the partner will see: counts only, never rows, and nothing runs until you accept.

01Why the shipped option wonIt put each guarantee next to the moment it mattered. Because nothing else interrupted the flow, the one irreversible step, handing over data, could carry its own terms and actually be read.
What the research changed
Finding
Sara's low point was the wait: three silent days of "Has anything happened?"
Decision
Every clean room states where it is and whose turn it is: waiting on the partner to accept, waiting on their data, sealed and awaiting compute, results ready.
Consequence
Silence becomes a status with a named owner, and "Nothing else is needed from you" tells her when she can stop checking.
Finding
Marco's low point was handing over data he can't take back, with legal asking for proof, not promises.
Decision
Before accepting, the data owner sees exactly what they're agreeing to: what they provide, the purpose, retention, and which computation runs. Nothing runs and no data moves until they accept.
Consequence
Legal gets something concrete to review, and the irreversible step comes with its terms written down.
Finding
Both sides needed to know what could leave the enclave. Research showed anonymisation thresholds were essential for adoption and compliance.
Decision
Every result is labelled aggregate-only, and buckets under 1,000 matched users are suppressed before results leave the enclave. The result screen says so.
Consequence
The guarantee is readable at the moment someone is looking at the data: "a count, not my list."
Finding
At setup, Sara was guessing at vocabulary nobody had taught her.
Decision
Setup became step by step with in-context guidance, and encryption is shown as it happens on her device: hash locally, encrypt with your key, upload, validate.
Consequence
An invisible technical guarantee becomes a sequence she can watch.

The publisher's seatThe same room from the data owner's side: the same aggregates, never the advertiser's member list.

  1. 1The publisher's seatThe same room, the other side
  2. 2Read the shared overlapAggregate match rate, no member list
  3. 3Explore the insightsAffinity, still only aggregates
  4. 4Switch seatsFlip back to the advertiser
app.decentriq.com/clean-rooms/q3-overlapLive prototype
The design system

Piloted on one feature, then rolled out.

I built a token-based system on top of an open-source foundation: built and shipped with one developer in four months, then rolled out across the platform over six. Rather than a platform-wide switch, we piloted it on a new feature first.

The Decentriq design system: components, tokens, and patterns
Audience patterns, iconography, colour tokens and components.
The rest of the platform

Two more surfaces around the core collaboration: a network to find data partners, and dataset preparation inside the enclave, so data never leaves its owner's control.

The Decentriq networkFind publishers and data partners to collaborate with.

  1. 1Browse the networkPublishers, data partners, collaborators
  2. 2Open a partnerSegments, matching ID, countries
  3. 3Reach outContact them to start a clean room
app.decentriq.com/networkLive prototype

Datasets and transformationsPrepare and transform data inside the enclave.

  1. 1Open your datasetsEncrypted with your own key
  2. 2Set up a transformationPick a type and a dataset
  3. 3Transform in-enclaveHash, filter or adjust the schema
  4. 4Ready to collaborateA new dataset, provenance attached
app.decentriq.com/datasetsLive prototype
Leading the team

The design team was two people: me, and one designer I managed. I owned the design system, which I built and shipped with one developer.

What changed

Adoption grew in the market it was built for.

New design system shipped
50%
development time reduced
Platform usage in Media
2023 vs 2024
active publishers
active advertisers
campaigns
20242023
New features and platform updates
75%
Product adoption growth in 1 year
Go to next →
LinkedIn GitHub CV Garage 68