Yes. We've had a third party cybersecurity firm, Echelon Risk & Cyber, audit the code and software for HIPAA Compliance. You can get a copy of the report

here.

No, Spindle's software includes this step as part of the package. You can find it located in the main software under "Transcryption" — this section specifically details how to send and receive data from partners.

No, tokenization is not the same thing as de-identification. The two methods of de-identification allowed by the Health Insurance Portability and Accountability Act (HIPAA) are called "Safe Harbor" and "Expert Determination".

Tokenization is often considered the first step of both de-identification methods, however federal regulations require additional transforming and evaluation of data for it to be considered de-identified, regardless of the de-identification method.

OPPRL is the abbreviation referring to the Open Privacy Preserving Record Linkage protocol. It is an open protocol for tokenization that allows organizations to exchange and link datasets in a safe manner that does not require the sharing of identifying attributes. All implementations of the OPPRL protocol are interoperable.

The Spindle Token is the canonical implementation of the OPPRL protocol. It is open source, portable, and scalable. The Spindle Token achieves this by being implemented in Python using Apache Spark.

Carduus was the original name of our tokenization software (v0), now known as the Spindle Token. As we learned, there's a reason Latin is considered a dead language. We're data experts, compliance specialists, and technologists — we'll work on getting the marketers.

Yes and no. v1 and v2 each introduced algorithmic updates that change token outputs for the same PII inputs — a token produced in v0 (Carduus) will not match one produced in v1 or v2. That said, all releases maintain backward compatibility, so tokens generated in earlier versions remain interoperable with current releases.

The Spindle Token enhances structured datasets with encrypted tokens that can be used in place of PII or other identifiers. After tokenizing a dataset, users should drop any sensitive attributes that should not be shared with recipients.

See our detailed documentation.

The Spindle Token solves the problems of tokenization and record linkage. Spindle Health provides additional products and services for data de-identification via Expert Determination including Certifications. For more information, please contact us.

Contact us.

Spindle Health is happy to help organizations with Spindle Token and OPPRL tokenization implementations. We are here to support your organization. If you are new to tokenization, we strongly encourage you to reach out and meet us. We have desktop applications and are happy to discuss other ways to support your organization.

The Spindle Token is free open source software (FOSS) that is managed publicly on Github in collaboration with the community of users and contributors.

View on Github.

The Spindle Token is open source software (OSS) and does not require a customized license for each user.

View the license on Github.

If you have any feedback — questions, bug reports, usability concerns, or proposals for improvements — please open an issue or a discussion on Github.

View the contributing guide.

If your data governance, compliance, or legal teams have questions about our software, open-source security, or any other compliance-related concerns, please contact us. Spindle has supported many organizations through these workflows and can provide documentation — including a third-party cybersecurity audit of our tokenization software — to ensure confidence in its compliance.

No, this is not a gimmick for adoption. Compliant data interoperability was something that was always promised and never delivered to the Real World Data industry, until now. The Spindle Token is a labor of love — built by people who spent their careers in this industry and wanted to leave it better than they found it. It is our gift to the community we care about deeply, and it always will be free.

Everyone. That's the point of open source — and if you're not on it yet, there's no reason you can't be. Organizations can onboard in minutes.

We don't publish a list. That's not an oversight — it's by design. Our goal was never another exclusive ecosystem forcing a selection of assets. It was broad, open, compliant interoperability for an industry that desperately needed it. The organizations we know about, we mostly can't name. But we're aware of 100+ and growing.

Ask for the Spindle Token. You'll be surprised who's already on it.