Herd privacy in a mediator
Our anonymity set is small.
That is the page. Everything below explains why it is the most important sentence on the estate's privacy pages, and why it is the one most often left out.
No security audit, and none of this has been externally reviewed.
The property
Anonymity is not a feature of a system; it is a property of a crowd. You are hidden among people doing the same thing at the same time. Take the crowd away and every technical control degrades at once: the mathematics still works, and it protects nothing, because there is nobody to be confused with.
The canonical illustration: if exactly one person uses a privacy feature, using it identifies them. The feature became a fingerprint.
See herd privacy.
Applied to a mediator
A mediator's metadata surface is timing, sizes, routing keys and volume, what a mediator can and cannot see. How revealing that is depends entirely on how many others are generating the same shapes.
- Ten thousand agents: a message arriving at 09:14 is unremarkable. Thousands did.
- A handful of agents: a message arriving at 09:14 is that agent, with near-certainty, and every technique in traffic analysis becomes dramatically cheaper.
Pairwise routing keys do not fix this. They stop a correspondent correlating your identities; they do not conjure a crowd. With few users, distinct keys are simply several visible identities belonging to an agent the operator can already single out.
Where Solidus Relay actually stands
Small. The public console preview renders sample data and says so; nothing on it is a population figure.
What that means for you, concretely: do not choose Solidus Relay for anonymity today. Choose it, if you choose it, because DIDComm mediation is the transport you need, because the operator surface fits, or because credential-gated admission is useful to you. Not because routing through it hides you in a crowd. There is not yet a crowd.
The uncomfortable corollary
Herd privacy cannot be engineered, only grown, which makes it the one privacy property a new entrant is structurally worst at, and therefore the one most likely to be glossed over in launch material. Padding, cover traffic and mixing can simulate a larger crowd at a cost, and Solidus Relay implements none of them (traffic analysis).
So the honest ordering is: a mature mediator with many users beats a new one with better intentions, on this axis specifically. If anonymity is your requirement, weigh that, including against running your own, which trades the crowd for control and is sometimes the better trade.
Why this page exists at all
Because a privacy section that lists only the properties we have would be advertising. This one is a property we do not have, stated plainly, on our own site. A reader who discovers it themselves concludes we were hiding it; a reader who finds it here can weigh it, and can trust the rest of the section more for having found it.