Even as Indigenous communities find increasingly helpful uses for digital technology, many worry that outside interests could take over their data and profit from it, much like colonial powers plundered their physical homelands. But now some Indigenous groups are reclaiming control by developing their own data protection technologies—work that demonstrates how ordinary people have the power to sidestep the tech companies and data brokers who hold and sell the most intimate details of their identities, lives and cultures.

When governments, academic institutions or other external organizations gather information from Indigenous communities, they can withhold access to it or use it for other purposes without the consent of these communities.

“The threats of data colonialism are real,” says Tahu Kukutai, a professor at New Zealand’s University of Waikato and a founding member of Te Mana Raraunga, the Māori Data Sovereignty Network. “They’re a continuation of old processes of extraction and exploitation of our land—the same is being done to our information.”

To shore up their defenses, some Indigenous groups are developing new privacy-first storage systems that give users control and agency over all aspects of this information: what is collected and by whom, where it’s stored, how it’s used and, crucially, who has access to it.

Storing data in a user’s device—rather than in the cloud or in centralized servers controlled by a tech company—is an essential privacy feature of these technologies. Rudo Kemper is founder of Terrastories, a free and open-source app co-created with Indigenous communities to map their land and share stories about it. He recalls a community in Guyana that was emphatic about having an offline, on-premise installation of the Terrastories app. To members of this group, the issue was more than just the lack of Internet access in the remote region where they live. “To them, the idea of data existing in the cloud is almost like the knowledge is leaving the territory because it’s not physically present,” Kemper says.

Likewise, creators of Our Data Indigenous, a digital survey app designed by academic researchers in collaboration with First Nations communities across Canada, chose to store their database in local servers in the country rather than in the cloud. (Canada has strict regulations on disclosing personal information without prior consent.) In order to access this information on the go, the app’s developers also created a portable backpack kit that acts as a local area network without connections to the broader Internet. The kit includes a laptop, battery pack and router, with data stored on the laptop. This allows users to fill out surveys in remote locations and back up the data immediately without relying on cloud storage.

Āhau, a free and open-source app developed by and for Māori to record ancestry data, maintain tribal registries and share cultural narratives, takes a similar approach. A tribe can create its own Pātaka (the Māori word for storehouse), or community server, which is simply a computer running a database connected to the Internet. From the Āhau app, tribal members can then connect to this Pātaka via an invite code, or they can set up their database and send invite codes to specific tribal or family members. Once connected, they can share ancestry data and records with one another. All of the data are encrypted and stored directly on the Pātaka.

Another privacy feature of Indigenous-led apps is a more customized and granular level of access and permissions. With Terrastories, for instance, most maps and stories are only viewable by members who have logged in to the app using their community’s credentials—but certain maps and stories can also be made publicly viewable to those who do not have a login. Adding or editing stories requires editor access, while creating new users and modifying map settings requires administrative access.

For Our Data Indigenous, access levels correspond to the ways communities can use the app. They can conduct surveys using an offline backpack kit or generate a unique link to the survey that invites community members to complete it online. For mobile use, they can download the app from Google Play or Apple’s App Store to fill out surveys. The last two methods do require an Internet connection and the use of app marketplaces. But no information about the surveys is collected, and no identifying information about individual survey participants is stored, according to Shanna Lorenz, an associate professor at Occidental College in Los Angeles and a product manager and education facilitator at Our Data Indigenous.

Such efforts to protect data privacy go beyond the abilities of the technology involved to also encompass the design process. Some Indigenous communities have created codes of use that people must follow to get access to community data. And most tech platforms created by or with an Indigenous community follow that group’s specific data principles. Āhau, for example, adheres to the Te Mana Raraunga principles of Māori data sovereignty. These include giving Māori communities authority over their information and acknowledging the relationships they have with it; recognizing the obligations that come with managing data; ensuring information is used for the collective benefit of communities; practicing reciprocity in terms of respect and consent; and exercising guardianship when accessing and using data. Meanwhile Our Data Indigenous is committed to the First Nations principles of ownership, control, access and possession (OCAP). “First Nations communities are setting their own agenda in terms of what kinds of information they want to collect,” especially around health and well-being, economic development, and cultural and language revitalization, among others, Lorenz says. “Even when giving surveys, they’re practicing and honoring local protocols of community interaction.”

Crucially, Indigenous communities are involved in designing these data management systems themselves, Āhau co-founder Kaye-Maree Dunn notes, acknowledging the tribal and community early adopters who helped shape the Āhau app’s prototype. “We’re taking the technology into the community so that they can see themselves reflected back in it,” she says.

For the past two years, Errol Kayseas has been working with Our Data Indigenous as a community outreach coordinator and app specialist. He attributes the app’s success largely to involving trusted members of the community. “We have our own people who know our people,” says Kayseas, who is from the Fishing Lake First Nation in Saskatchewan. “Having somebody like myself, who understands the people, is only the most positive thing in reconciliation and healing for the academic world, the government and Indigenous people together.”

This community engagement and involvement helps ensure that Indigenous-led apps are built to meet community needs in meaningful ways. Kayseas points out, for instance, that survey data collected with the Our Data Indigenous app will be used to back up proposals for government grants geared toward reparations. “It’s a powerful combination of being rooted in community and serving,” Kukutai says. “They’re not operating as individuals; everything is a collective approach, and there are clear accountabilities and responsibilities to the community.”

Even though these data privacy techniques are specific to Indigenous-led apps, they could still be applied to any other app or tech solution. Storage apps that keep data on devices rather than in the cloud could find adopters outside Indigenous communities, and a set of principles to govern data use is an idea that many tech users might support. “Technology obviously can’t solve all the problems,” Kemper says. “But it can—at least when done in a responsible way and when cocreated with communities—lead to greater control of data.”