Need-to-Know Field Signals
High-risk-customer handling, credit flags, two-person-rule triggers — circulate only the fact that a case applies, never the reason or basis. The underlying data stays with the back office (authorized staff); the front line acts on the mark, and the basis for issuing it can be proven after the fact for audit. Keep your existing customer management and blacklist sharing — add only a proof layer.
For teams circulating risk flags to the front line
Resolve the bind between showing a flag's reason — inviting leakage and inconsistent judgment — and hiding it, leaving you unable to prove the flag was legitimate, by circulating only the fact that a case applies, without revealing the basis.
-
Retail & services, hospitality, and membership businesses running customer-handling flags (customer management, blacklist sharing)
-
Finance & insurance teams sharing credit flags, transaction restrictions, or high-risk parties with the front line
-
Public & infrastructure teams circulating risk signals such as two-person-rule triggers to the field
Hand over the source, or just the facts?
Nothing changes on the floor. Everything changes for the receiver.
① Your team just saves, as always.
- The usual action
- Enter the record, hit save
- On save
- a proof is attached (one API call behind the scenes)
- The document
- never sent
② They just open a link.
- Proven fact
- the handling tier you need (flagged / normal)
- the reason, history and score behind the flag
- not shown
- Login / keys
- not needed
- The document stays private — the record itself is never sent or disclosed.
- Independent verification — the receiver just opens a link. No account, no keys.
- Edits are detected — even a one-character edit fails verification.
The front line receives only a "handling category" (flagged / normal) as a proof — never the reason or history. The basis is viewable via selective disclosure by authorized staff (e.g. managers) only, and who set the flag, when, and on what basis stays tamper-proof as provenance.
The front line not holding the reason is itself need-to-know minimization — reducing leakage and inconsistent judgment. And later, against complaints, subject-access requests, or audits, "the flag was legitimate" can be explained while opening the basis only as needed.
- The front line sees only the mark (the details stay on the org side via selective disclosure)
- At audit time, the basis for issuing the mark can be proven after the fact
- Your existing customer-management system stays as-is — you add only the proof layer
(A lawful operating design — flagging criteria, subject notification, retention — is assumed; we design this separately with legal.)
Why the usual methods fall short.
Only work that needs all three at once — pass without exposing, independent verification, tamper-evidence — is Lemma's domain.
| Method | Pass without exposing | Independent verification | Tamper-evident | What happens |
|---|---|---|---|---|
| Access control / permissions | △ | ✗ | ✗ | “Someone inside could have edited it” remains possible |
| Masking / redacted copies | △ | ✗ | ✗ | Redaction work grows; the original is still unproven |
| Encrypt and store / send | ✓ | ✗ | ✗ | To verify, the receiver needs it disclosed after all |
| Monitoring only | △ | ✗ | ✗ | Detection only — the receiver still cannot verify independently |
| Lemma (ZK proof)the only one with all 3 | ✓ | ✓ | ✓ | The receiver just opens a link |
How it works — and how to start.
We help design disclosure scope and retention, run the PoC, and support production.
Start with a 30-minute call.
Tell us the one customer-handling flag where reason-disclosure risk is heaviest, in the first 30 minutes. No disclosure of sensitive data required.
Find the case that matches your industry and problem
Browse all 36 use cases →TRY LEMMA
Run it yourself.
No sales call needed — start hands-on with Lemma's products.