On the Fly: Homomorphic Encrypted Web API

Česká Spořitelna will allow third parties access to their Web API. Some APIs provide access to client data (after client impersonation - OAUTH2), allowing partner applications to show clients their products and transaction history. 

A problem occurs in situations where a partner application needs to solve more complex problems with the provided data.

For example: Cloud accounting implements a function of pairing issued invoices and incoming payments. This means the transaction history of an account is continuously obtained from an API, stored in the application’s database, and then, the corresponding payment is retrieved. In addition to the client’s transaction history, it also provides a cashflow analysis - balance sheets, outstanding and paid invoices, and payment behavior. 

Storing client data in a third party application is controversial. First of all, it is inconsistent with the Česká Spořitelna Developers Agreement. Second, it is subject to regulation (personal data, bank secrecy, banking compliance services, operational and reputational risk, misuse of client data, etc.). 

The solution may be to provide data to a third party in a non-transparent form, while at the same time making it possible to transform, aggregate, and search data in a system and provide value to the customers who want it. The concept of homomorphic encryption allows this approach.