Confidential benchmarking on Terminal 3
Salary benchmarks that survive being checked.
Competitors will not email each other payroll, and lawyers will not let them. Blindband takes the sealed rows into an enclave, publishes a band only when it clears four safe-harbour gates, and writes the result's fingerprint to a public ledger. You do not have to believe the operator. You can recompute the number yourself.
- Backend Engineer L4$9,344
- Backend Engineer L5$14,627
- Backend Engineer L6$18,752
- Product Designer L4$7,981
- Data Scientist L5withheld
- Engineering Manager M2withheld
round digest
e4f528ad321626b2daf9b667188937609cd160a21a739d542eabd44a2f40beef
Anchored on Solana devnet ↗- bands published
- 4
- cells withheld
- 2
- contributing firms
- 9
- sealed rows
- 117
bands published
cells withheld
contributing firms
sealed rows
The problem
Every pay survey asks you to trust a stranger with your payroll.
The usual arrangement is a vendor: each firm mails a spreadsheet, the vendor promises to keep it confidential, and months later a PDF comes back. The firms cannot see what happened in between. Neither can their regulators. And the one rule that actually matters — that a benchmark must not become a channel for competitors to read each other's current pay — is enforced by nothing more than an assurance.
How it runs
Three moves, and only one of them requires trusting anything.
01
Rows go in sealed
Each member posts its rows to a contract running inside a trusted execution environment. The rows land in a private key-value map that only the contract's own identity can read. There is no operator console that opens them, because there is no code path that returns them.
02
The enclave decides what may be said
The aggregation runs where nobody can watch it. Every cell is tested against the four gates. A cell that passes is published as a percentile band. A cell that fails is named, with the reason it failed, and its numbers are never emitted — not to members, not to the operator.
03
The result is pinned in public
The published round is hashed, the digest is bound into the transaction receipt, and the same digest is written to Solana as a memo. That gives the round an independent timestamp and an append-only history, so a round cannot be swapped for a friendlier one after the fact.
The contract asks for three host capabilities: key-value storage, logging, and tenant context. It does not ask for outbound HTTP, so there is no egress surface to review.
The whole thing, in sixty-three seconds
blindband/agent
$npm run deploy
Register the contract and scope the sealed maps to it.
The ruleset
Four gates on the first round. Five on every round after it.
These are not tuning knobs. They are compiled into the contract and named in the published round, so a member can see which ruleset produced the number they are reading.
Neutral aggregator
01no member sees another's rows
The aggregation runs inside the enclave and the sealed map is scoped to the contract identity alone. Members receive bands, never rows.
Historical data
02effective date at least 91 days old
Anything more recent is dropped from the round and counted in the totals. Current pay is the figure competitors are not permitted to swap; stale pay is the figure they are.
Contributor floor
03at least 5 firms and 10 rows per cell
Below that, a band starts to describe individuals rather than a market. The cell is named as withheld and its statistics are discarded.
Concentration ceiling
04no firm above 25% of a cell
A band that is mostly one employer is that employer's payroll wearing a market's clothes. Over the ceiling, the cell is withheld.
Differencing guard
05no delta attributable to one firm
The four gates above each judge a single round, and a consortium runs every quarter. If one firm joins or leaves a cell, the change in that cell's median was computed from its rows alone — subtract two rounds and you have read it. A cell is published again only if its contributor set is unchanged from every round it was published in before, or differs from each of them by at least two firms — the whole history, because an observer keeps every round they have seen. The round on this page was the first, so it had nothing behind it to be differenced against.
Blindband is engineering, not legal advice. The gates follow published safe-harbour guidance; whether they fit a particular consortium is a question for that consortium's counsel.
Live round · 2026-q1
What the enclave published, and what it refused to.
Everything below came out of a real contract execution on the Terminal 3 sandbox and is anchored on Solana devnet. Nothing on this page is illustrative.
Backend Engineer · L4
9 firms · 25 rows · top firm 16.0%
Backend Engineer · L5
9 firms · 32 rows · top firm 15.6%
Backend Engineer · L6
7 firms · 22 rows · top firm 18.2%
Product Designer · L4
6 firms · 19 rows · top firm 21.1%
Data Scientist · L5
5 firms · 13 rows
One firm accounted for more than a quarter of the cell's rows.
Engineering Manager · M2
3 firms · 6 rows
Fewer than five independent firms contributed to this cell.
These cells had data. The enclave computed them and then declined to publish, which is the part of the system that is worth anything.
Verification
Check it here, in your own browser.
Two of the three checks need nothing from us. Your browser hashes the round file it just downloaded and compares that against the fingerprint recorded on Solana. If an operator ever served you a different round, these two numbers would part company.
01
Recompute the digest
SHA-256 over the exact bytes of the published round, computed locally with the Web Crypto API.
anchored on solana
e4f528ad321626b2daf9b667188937609cd160a21a739d542eabd44a2f40beef
02
Read the anchor
The same digest, written to Solana devnet as a memo at the slot shown. Public, timestamped, and not ours to edit.
slot
492821211
block time
2026-09-04 03:20:46 UTC
signature
5uczxVJUm4zjwDms6R5eDC9H1G3gypRUuDA1p2B1x14bXP8QCezrFxZLgfRzfGCJLG3HDJ7ubfsWpiZBG4AJE3Hf
03
Prove a receipt belongs
Each accepted row returns a commitment. Ask whether that commitment is in the round, and whether its cell reached a published band.
64 hexadecimal characters, as returned when the row was accepted.
The receipt lookup on this page answers from the sample set shipped with the site, so it works offline and spends nobody's credits. The authoritative answer comes from the enclave: npm run verify in the repository asks the contract directly, and includes a deliberately forged commitment as a control.
Questions
The awkward ones first.
Could the operator read the submissions anyway?
There is no function that returns a row. The sealed map's access list names the contract identity and nothing else, and the contract exposes submit, aggregate, read-round and check-receipt. Adding a read path would mean registering a new contract version under a new identity, which is a visible act, not a quiet one.
What stops a round being replaced later?
The digest on Solana. Republishing a different round under the same identifier produces a different hash, and the original memo stays where it is with its original block time. The substitution does not become impossible — it becomes obvious.
Why is a whole cell thrown away over one dominant contributor?
Because a band drawn mostly from one employer tells the other members what that employer pays. That is the exchange the safe-harbour conditions exist to prevent, and publishing it with a footnote would not fix it.
What does a member actually get back?
A receipt per accepted row, and the published bands. The receipt proves the row was counted without revealing it. Nothing in the response describes another member's data.
Is this ready for a real consortium?
The pipeline is real and the gates work, but it runs on a sandbox tenant with test credits, and rounds currently execute under the tenant identity rather than a delegated agent key. Those are the two things to close before anyone's actual payroll goes near it.
Could two rounds, compared, reveal what one round withheld?
They could, and there is a fifth gate for it. The first four gates each judge a single round, and a consortium runs every quarter: if one firm joins or leaves a cell, the change in that cell's median was computed from that firm's rows and nothing else, so subtracting two rounds reads it off. Gate 5 republishes a cell only if its contributor set is unchanged, or if at least two organisations moved at once, so no delta belongs to one firm. You can watch it work on the real submissions: `cargo run --example replay -- --differencing` prints the figure the first four gates would have leaked, then withholds the cell. It compares against every round a cell was published in, not just the last one: withhold a cell in Q2, republish it in Q3 with one firm fewer than Q1 had, and no adjacent pair catches it while Q3 − Q1 still names that firm. One limit remains, and it is small: the withholding itself says that one organisation moved, which is far less than the numbers it protects. The published round carries `blindband-safe-harbour/v1` because it was the first, with nothing behind it to difference against; the next round carries v2.
Run a round yourself.
The contract, the agent and this site are one repository. Deploy, submit, aggregate, anchor, verify — five commands, and the last one tells you whether to believe the first four.