Analyse data without centralising it

Why data gets gathered in the first place

For a good reason: a model learns better when it sees more cases. A plant that has only recorded a few dozen failures has nothing to learn from. A hospital sees enough cases to treat patients, rarely enough for a model to spot rare situations. A bank discovers a fraud pattern that the next one has never seen.

The historical answer has been to bring everything into one place, an analytics warehouse or a data lake. It works, and at the same time it creates a convergence point that concentrates both the data and the access to the systems it came from. That point became the path of several French breaches in 2026, documented by the affected organisations themselves: see the breach comes from the copy.

And in many situations, gathering is not even possible. Two competitors do not exchange their shop floor records. A subcontractor does not show its costs to its client. A hospital does not release patient files. The project stops there, and not for a technical reason.

Moving the computation rather than the data

The alternative reverses the flow. Instead of bringing the data to the computation, you bring the computation to the data.

• The shared model is sent to each participant.
• Each trains it on its own infrastructure, on its own records, which do not move.
• Only the parameter update travels back, end-to-end encrypted.
• A coordinator aggregates those updates into a new version of the model, which everyone gets.
• Repeat, round after round, until the model stops improving.

At the end, each participant holds a model that learned from the whole of the data, without a single record changing hands. That is the principle of federated learning, and it works between the sites of one company as well as between separate organisations.

What travels is parameters, never records. Transport is end-to-end encrypted, with RSA-OAEP 2048 for key exchange and AES-GCM 256 for content. Mesh does not compute on encrypted data: the participant decrypts the model before training it, and the coordinator decrypts the updates before averaging them. Enclave execution and advanced hardening are offered as options.

What it changes about exposure surface

This architecture does not reduce the probability that a piece of software is vulnerable. An unpatched tool stays exploitable, a stolen credential stays usable, each site still has to be protected as before.

What it changes is what is reachable when something falls. An intrusion at one participant reaches that participant's data, not the others', because there is nowhere that they were brought together. There is no gathered copy to exfiltrate, and no central instance holding the credentials of every database in scope.

It is also the data minimisation reading of the GDPR: data you do not copy is data you do not have to protect elsewhere, nor notify elsewhere.

What it does not replace

Federated learning covers model training on distributed data. It does not cover everything.

• Ad hoc exploration, when an analyst has to read records row by row to understand an anomaly, still requires direct access.
• Regulatory reporting and operational steering keep their tools and their existing pipelines.
• Data quality and consistency remain hard work, and distribution makes it more demanding, not less: participants have to agree on a shared vocabulary.

So the useful question is not to remove every warehouse. It is to look, use case by use case, at which ones never required the copy that was built for them.

When it is worth it

Three configurations come up.

Several sites of one organisation, each with too little history to train a useful model alone, where gathering would raise a sovereignty, contractual or transfer volume problem.

Several organisations with the same problem that cannot open up to each other, because they compete, or because the data is covered by trade secret or by a specific protection regime.

A value chain where each actor only sees its own link, and where the quantity being sought depends on all of them.

Conversely, if the data is already legitimately gathered, held by a single party with no sharing constraint, federated learning adds complexity without adding value.

How it gets set up

How a project works sets out the stages and the cost structure. The usual order: frame the question the model has to answer, check that each participant holds the necessary variables, agree on a shared vocabulary, then run a first training cycle on a reduced scope before widening it.

A demo on real public data shows the mechanism at work on open, cited datasets, with their source and licence.

Mesh is at launch stage. No production deployment exists to date, and the demo simulates participants inside a single process. The ROI calculator gives an order of magnitude of the expected gain by number of participants.