ExPriori · an independent project in the public interest

Answers that span NHS organisations, without moving anyone's patient data

ExPriori is a privacy-preserving computation platform that Firebed undertook independently, not for profit and in the public interest. It lets NHS organisations compute an aggregate answer together while each keeps its own records: no party, ExPriori included, ever holds another party's patient data in readable form. It is provided to NHS organisations free in perpetuity.

The problem it addresses

NHS organisations routinely need answers that span several of them. How many patients with this rare condition exist across the region? Does this pathway change reduce readmissions across the whole integrated care board? Does this cohort exist in sufficient numbers to justify a trial? Answering those questions today means moving identifiable or pseudonymised records into somebody's environment, and that movement is what patients, clinicians and regulators object to.

ExPriori's proposition is that the arithmetic can be done without the movement. Each participating organisation keeps its records, contributes only cryptographic shares of them, and the correct aggregate emerges through multi-party computation. The privacy property is mathematical rather than contractual or procedural, which is the difference between ExPriori and anonymisation, trusted research environments or federated learning without cryptographic guarantees.

What it is built from

Multi-party computation: SPDZ-family protocols with MAC-checked results across separate machines; means, variances, threshold counts and stratified statistics computed jointly without a trusted party seeing inputs.
Post-quantum cryptography: FIPS 203 ML-KEM-1024 and FIPS 204 ML-DSA-87, with hybrid signatures and algorithm registries so the platform can move to a new suite by registration rather than rewrite. Implemented, cross-checked against an independent reference; not FIPS-validated.
Self-sovereign identity: W3C verifiable credentials and decentralised identifiers for organisations and operators, and a consent gate that stands in front of every computation.
Solid pods: Patient-controlled data stores behind an adapter that keeps the platform agnostic to whether ExPriori, the NHS or the patient's chosen provider hosts the pod.
Governance built in: A requirements register, a threat model, a penetration-test programme, a CAF-aligned DSPT map, a draft DPIA, a clinical safety case and continuous integration gates that refuse a change whose evidence has gone stale.

Where it stands, stated plainly

Honest status, September 2026

ExPriori is a Beta candidate, demonstrated across three separate machines on a local network. It is not deployed anywhere.
No live patient data has ever been processed. Every demonstration, test and fixture uses synthetic data; the draft DPIA records this.
Several advertised cryptographic protocols remain registered scaffolds rather than working implementations. Each carries a marker that continuous integration counts, and the front page of the repository lists them.
The post-quantum implementations are cross-checked byte for byte against the PQClean reference. They are not FIPS-validated and hold no CAVP certificate.
Internally assessed at technology readiness level 5 to 6. The gate to level 7 is access to an NHS sandbox environment, not further coding.

Why it is free to the NHS

ExPriori was built because the capability gap is real and nobody was going to fill it on the NHS's behalf. It is licensed to UK NHS organisations free of charge in perpetuity, as-is, with the organisation taking responsibility for its own maintenance and feature choices. Third-line support is available commercially from Firebed but is never required. Firebed retains the intellectual property so the licence can be granted cleanly and the platform maintained; Firebed may license the underlying methods in other sectors, and the NHS grant is unaffected by that.

What we are looking for

An NHS sandbox partner. A Trust, integrated care board or research body willing to host a three-organisation trial on synthetic data in an NHS environment.
Digital, information-governance and clinical-safety leaders who will read the DPIA, the safety case and the DSPT map critically.
Contributors. Rust engineers, cryptographers, security testers, technical writers. Register an expression of interest.

The engineering programme

What "end to end" meant in practice

The four services on this site were not designed in the abstract. They are the loop ExPriori went round, several times.

Design
Threat model firstSystem decomposition, 13 trust boundaries, an attacker catalogue for the UK health sector and critical national infrastructure, three attack trees.
Develop
Traced and gatedRequirements before code, tests before implementation, statuses that move only on code-level evidence, gates in CI for every governance rule.
Pentest
A programme, not an eventRules of engagement, an exploit catalogue re-derived at each head, a rig, and the discovery that unreachable controls were the dominant defect class.
Remediate
Closed by compilationFindings closed with regression gates; the strongest closures verified by a probe crate that requires the removed symbols to be absent from the default build.

Questions we are asked

ExPriori, in brief

Is ExPriori free for the NHS?

Yes. ExPriori is provided to UK NHS organisations free of charge in perpetuity, as-is, under a licence that the organisation maintains for itself. Third-line support is available commercially from Firebed but is never required.

Has ExPriori processed real patient data?

No. Every demonstration, test and fixture to date uses synthetic data. The draft data protection impact assessment records this, and no live deployment exists.

Is ExPriori deployed anywhere?

Not yet. It is a Beta candidate demonstrated across separate machines on a local network. The gate to the next readiness level is access to an NHS sandbox environment, not further coding.

Who owns ExPriori?

The intellectual property is held by Firebed Ltd so that the NHS licence can be granted cleanly and the platform maintained. No NHS organisation pays for it. Firebed may license the underlying methods in other sectors; the NHS grant is unaffected.

Can my organisation trial it?

Yes, on synthetic data today, and in an NHS sandbox when one is available. Use the contact page and say which organisation you represent.