1.9 KiB
ADR 0006: Suppress under-sized peer benchmarks
- Status: Accepted
- Date: 2026-08-20
Context
The product may compare a merchant's metrics with anonymized merchants in the same approved cohort. Comparisons built from very few businesses can reveal competitive information, and comparisons built from too few payment sessions are unstable. The five source categories contain 25, 38, 53, 69, and 158 merchants over the full dataset, so a useful minimum can be enforced without disabling category benchmarks globally.
Decision
Exclude the active merchant from every peer aggregate. Display a peer benchmark only when its selected cohort and reporting window contain both:
- at least 10 other eligible merchants; and
- at least 1,000 combined peer payment sessions.
If either condition fails, return a typed suppressed result rather than a numeric value. The UI explains that there is not enough data for a reliable comparison. Suppression applies only to peer comparisons; authenticated merchants retain access to their own permitted analytics.
Peer cohorts and reporting windows come from an approved allowlist. Merchant-facing clients cannot construct arbitrary cross-merchant filters that could isolate a competitor or recover values by differencing nearby queries. Individual peer identities, values, rows, and ranks are never returned.
Consequences
- Benchmarks are less likely to expose a small set of competitors or amplify tiny samples.
- Narrow date windows may suppress otherwise valid category comparisons; the UI may suggest a broader approved period.
- API contracts distinguish available, suppressed, and unavailable/error states.
- Tests cover both thresholds, exclusion of the active merchant, fixed cohort definitions, and attempts to vary filters around the threshold.
- The thresholds are product policy, not a formal anonymity guarantee; changing them requires a reviewed ADR and security/privacy assessment.