Xgene: Cross-Jurisdiction Genomic Data Sharing

Executive Summary

Cross-border genomic research requires data to comply with GDPR, HIPAA, PIPEDA, and APPI simultaneously. Xgene makes this mathematically possible by splitting genomes across jurisdictions so that no single regulator or court order can reconstruct the data.

Two functions cover the core workflow: splitGenome() takes a VCF/FASTQ/BAM file and consent record, validates consent covers all target jurisdictions, splits the genome into XorIDA shares (default 2MB chunks), and distributes shares to jurisdiction-specific endpoints. reconstructGenome() collects threshold shares from authorized jurisdictions, verifies HMAC integrity, and reconstructs the original genome with SHA-256 hash verification.

When an attacker compromises a single jurisdiction's storage, they learn exactly zero bits about the genome — not computationally hard to break, but information-theoretically impossible. XorIDA operates over GF(2) with threshold K. Any K-1 or fewer shares reveal zero information, regardless of computing power or quantum capability.

Consent validation is mandatory and enforced before any cryptographic operation. The system rejects split requests if consent does not explicitly authorize all target jurisdictions. This ensures regulatory compliance at the protocol level, not just policy level.

Developer Experience

Xgene provides structured error codes and Result-based error handling to make cross-border genomic sharing safe and debuggable.

Error Categories

Xgene organizes 7 error codes across 4 categories for systematic handling:

Result Pattern

All operations return Result<T, GenomicShareError>. Every error includes a machine-readable code and human-readable message.

const result = await splitGenome(genomeData, metadata, config, consent);

if (!result.ok) {
  switch (result.error.code) {
    case 'CONSENT_INVALID':
      console.error('Missing required consent fields');
      break;
    case 'JURISDICTION_MISMATCH':
      console.error('Consent does not cover target jurisdictions');
      break;
    case 'SPLIT_FAILED':
      console.error('XorIDA split operation failed');
      break;
  }
  return;
}

// Use result.value.manifest and result.value.shares

The Problem

Genomic data sharing across jurisdictions violates privacy laws. Single-location storage creates permanent breach risk for the most sensitive personal data that exists.

Genomic data is irreversible. Unlike passwords, you cannot change your genome after a breach. A single compromise exposes lifelong health risks, ancestry, paternity, predispositions to disease, and information about biological relatives who never consented.

Cross-border research is legally paralyzed. EU biobanks cannot share with US institutions under GDPR Article 5 data minimization. Canadian researchers face PIPEDA restrictions. Japanese pharmacogenomics projects cannot pool data across APPI and HIPAA jurisdictions. Each jurisdiction demands the data stay within its borders.

Centralized storage is a single point of failure. The 23andMe breach exposed 6.9 million genetic profiles. MyHeritage leaked 92 million accounts. GEDmatch was accessed without warrants. Every centralized genomic database is a catastrophic breach waiting to happen.

Existing solutions fail. Encryption-at-rest still leaves the database server with full access to plaintext during queries. Federated learning leaks information through gradient updates. Homomorphic encryption is too slow for genome-scale computation. Differential privacy adds noise that destroys rare variant signals critical for precision medicine.

Real-World Use Cases

Six scenarios where cross-jurisdiction genomic splitting enables research that is currently impossible.

Solution Architecture

Three-layer architecture: consent validation, XorIDA splitting, and jurisdiction routing.

Consent Enforcement

Consent validation happens before any cryptographic operation. This is not a checkbox to skip — it is a protocol-level requirement.

const consent: ConsentRecord = {
  subjectId: 'SUBJ-001',
  purpose: 'rare-disease-research',
  grantedBy: 'patient',
  grantedAt: new Date().toISOString(),
  authorizedJurisdictions: ['DE', 'CA', 'JP'],
  expiresAt: '2027-04-10T00:00:00Z', // Optional
};

The authorizedJurisdictions array must include every jurisdiction code in the split configuration. If the config specifies shares for DE, CA, and JP, but consent only authorizes DE and CA, the operation fails with JURISDICTION_MISMATCH.

Consent Audit Trail

Every GenomicManifest includes the full consent record. Reconstruction does not re-validate consent (that is the data controller's responsibility), but the manifest provides an immutable record of the original authorization.

Chunking Strategy

XorIDA operates on fixed-size chunks. Large genomes (whole genome sequencing = 100-200GB) are split into 2MB chunks by default, each independently split into shares.

Why 2MB? Trade-off between memory efficiency and parallelization. Smaller chunks (e.g., 512KB) increase manifest size and reduce per-chunk throughput. Larger chunks (e.g., 16MB) increase memory pressure and reduce parallelization opportunities. 2MB fits comfortably in Node.js default heap and allows ~100 parallel chunks on typical research servers.

Each chunk is independently split. The manifest contains per-chunk metadata: chunk index, total chunks, original size, data hash (SHA-256 of the full genome, not per-chunk). Shares for chunk N are stored with chunkIndex: N in the GenomicShare structure.

const config: GenomicShareConfig = {
  jurisdictions: [
    { code: 'DE', name: 'Germany', regulation: 'GDPR', endpoint: 'https://de.store' },
    { code: 'US', name: 'United States', regulation: 'HIPAA', endpoint: 'https://us.store' },
  ],
  threshold: 2,
  chunkSize: 8 * 1024 * 1024, // 8MB for reduced manifest size
};

Integration Patterns

Three integration patterns for different genomic data workflows.

Biobank Federation

import { splitGenome } from '@private.me/genomicshare';

const vcfData = fs.readFileSync('patient-123.vcf');

const config = {
  jurisdictions: [
    { code: 'GB', name: 'UK', regulation: 'GDPR', endpoint: 'https://uk-biobank.store' },
    { code: 'US', name: 'US', regulation: 'HIPAA', endpoint: 'https://all-of-us.store' },
    { code: 'FI', name: 'Finland', regulation: 'GDPR', endpoint: 'https://finngen.store' },
  ],
  threshold: 2,
};

const consent = {
  subjectId: 'PATIENT-123',
  purpose: 'cardiovascular-gwas',
  grantedBy: 'patient',
  grantedAt: new Date().toISOString(),
  authorizedJurisdictions: ['GB', 'US', 'FI'],
};

const result = await splitGenome(vcfData, metadata, config, consent);
// Shares distributed to UK Biobank, All of Us, FinnGen
// Each sees only unintelligible XorIDA share

Clinical Trial Data Distribution

// Trial sites in Germany, Canada, Japan
const siteJurisdictions = [
  { code: 'DE', endpoint: 'https://site-berlin.trial' },
  { code: 'CA', endpoint: 'https://site-toronto.trial' },
  { code: 'JP', endpoint: 'https://site-tokyo.trial' },
];

// Each site gets one share, any 2 reconstruct
const config = { jurisdictions: siteJurisdictions, threshold: 2 };

// Consent must cover all trial sites
const consent = {
  subjectId: 'TRIAL-456',
  purpose: 'oncology-phase-2',
  grantedBy: 'patient',
  grantedAt: trialEnrollmentDate,
  authorizedJurisdictions: ['DE', 'CA', 'JP'],
  expiresAt: trialEndDate,
};

Reconstruction for Analysis

import { reconstructGenome } from '@private.me/genomicshare';

// Fetch shares from authorized jurisdictions only
const sharesDE = await fetchSharesFromJurisdiction('DE', manifestId);
const sharesCA = await fetchSharesFromJurisdiction('CA', manifestId);

// Group shares by chunk index
const sharesByChunk = groupSharesByChunk([sharesDE, sharesCA]);

const result = await reconstructGenome(manifest, sharesByChunk);
if (result.ok) {
  const genome = result.value; // Uint8Array, SHA-256 verified
  // Run GWAS, variant calling, etc.
}

Security Properties

Five layers of protection. Each independently verifiable.

Information-Theoretic Security

XorIDA operates over GF(2) (binary field). With threshold K=2 and N=3 jurisdictions, any single jurisdiction sees a share that is cryptographically indistinguishable from random noise. Not "hard to break with current computers" — impossible to break even with infinite computing power, including quantum computers.

Comparison to Alternatives

Benchmarks

Performance characteristics measured on Node.js 22, Apple M2.

Honest Limitations

What Xgene cannot do, and why.

Partial Reconstruction Not Supported

If a single chunk has fewer than K shares, the entire genome reconstruction fails. For a 100GB genome with 50,000 chunks, all 50,000 chunk groups must have K shares. Missing share for chunk 1 = total failure, even if the other 49,999 chunks are complete. This is intentional — partial genomes create privacy risks (e.g., reconstructing only exome regions while leaving whole genome incomplete).

Consent Re-Validation on Reconstruction

The package validates consent before splitting but does not re-validate on reconstruction. The manifest includes the original consent record for audit purposes, but reconstruction logic does not check if consent has expired or been revoked. This is the data controller's responsibility — typically enforced at the API layer that calls reconstructGenome().

No Built-In Transport

The package does not handle HTTPS POST to jurisdiction endpoints. The splitGenome() function returns shares and a manifest. Distributing shares to jurisdiction endpoints is the caller's responsibility. This is intentional — different deployments have different network topologies (direct HTTPS, message queues, S3 presigned URLs, etc.).

Memory Usage for Large Genomes

A 100GB genome with 2MB chunks requires ~30MB of manifest metadata in memory (50,000 chunks × ~600 bytes per chunk metadata). For 200GB whole-genome sequencing, manifest overhead is ~60MB. This fits in Node.js default heap, but applications processing thousands of genomes concurrently should monitor memory usage.

No Homomorphic Computation

Xgene provides jurisdiction-isolated storage, not homomorphic computation. You cannot run GWAS directly on split shares. To analyze the genome, you must reconstruct it (requires K shares). If your threat model includes "authorized analyst must never see plaintext," consider secure multi-party computation or trusted execution environments in addition to jurisdiction splitting.