Pooling orders without showing your books

Independent pharmacies, bakeries, clinics and hardware stores order by the carton while chains order by the trainload and get wholesale discounts. Pooling orders would close much of the gap, but local buying groups often stall because no owner wants a nearby competitor to see their order sizes.

Modern cryptography removes that trade-off: a pool can learn the combined total without anyone seeing an individual order.¹

Three bakeries, one train car of flour, and a locked ballot box

To see how neighbours can pool buying power privately, imagine three independent bakeries in the same town. Each morning, all three bake bread and pastries for local families. Each bakery buys standard bread flour in fifty-pound sacks from a middleman at a high retail markup.

The regional grain mill down the railway line offers a steep wholesale discount on a full railcar of two hundred sacks. None of the three bakeries has the storage room or cash to buy two hundred sacks alone. Together, though, they easily use two hundred sacks a month.

Why don't the three bakers simply trade order sheets over coffee? Because their order sheets reveal competitive secrets. One baker uses a rare rye blend for her sourdough; sharing her full invoice would give away her recipe. Another baker just booked twelve summer weddings; a sudden jump in butter and sugar orders would reveal his summer sales.

Now imagine the three bakers use a locked ballot box at the local credit union. Each baker writes only the shared staple, standard bread flour, and the number of sacks they want on a note. They seal the note inside an unmarked envelope and drop it through the slot.

The ballot box follows a strict rule. It never opens an individual envelope or reveals what one bakery wrote. Instead, it silently weighs the stack inside. Once at least three shops join and the combined total reaches two hundred sacks, a green light clicks on and prints one combined order for the mill.¹

Anything the bakeries do not share in common, like the secret rye blend, never registers at all. Every baker keeps their secret recipes, customer lists, and sales volume private, while all three split the train car of flour at the wholesale price.

How blind order matching works on your computer

In software, that locked ballot box is built using a privacy technique called blind set matching.¹ Instead of emailing spreadsheets to a commercial middleman, each clinic or shop keeps its inventory records strictly on its own office computer.

Let us trace how the three healthcare clinics in the diagram above (Oak Street Clinic, Elm Street Pharmacy, and Riverside Care) use this tool one morning. All three need to restock standard examination gloves. The regional medical distributor requires a minimum order of one hundred boxes to unlock the wholesale hospital rate.

Oak Street Clinic needs forty boxes, Elm Street Pharmacy needs thirty boxes, and Riverside Care needs fifty boxes. Buying alone, each clinic falls short of the one-hundred-box threshold and gets hit with retail catalog pricing plus small-order handling fees.

When they use a local purchasing assistant, each clinic's computer turns its item catalog number and desired quantity into a scrambled mathematical envelope.¹ The three assistants compare those scrambled envelopes across a peer-to-peer connection. Without any clinic seeing the others' numbers, the math verifies that all three want the same gloves and need one hundred and twenty boxes in total.¹

What if only two clinics had joined that week, or what if their combined total had only reached seventy boxes? Then the ballot box stays completely silent.¹ Nobody learns who submitted an envelope or how many boxes they wanted. That threshold rule prevents a curious competitor from submitting fake tiny orders just to probe what the shop down the street is buying.

Once the one-hundred-box threshold is met, the combined order triggers automatically. The regional distributor receives a single verified bulk order for one hundred and twenty boxes, unlocking the wholesale discount tier. Each clinic receives its own shipment at its own loading dock and pays its own invoice directly.

Why traditional group purchasing organizations fall short

Some readers may wonder: don't traditional Group Purchasing Organizations, or GPOs, already pool orders for smaller clinics and shops? They do, but traditional middlemen come with three heavy strings attached.

First, traditional brokers require members to hand over detailed purchasing histories and invoice ledgers to a central corporate database. Second, many commercial purchasing groups collect administrative rebates and vendor fees that eat up a large slice of the wholesale discount. Third, traditional brokers usually lock members into rigid, multi-year exclusive catalogs.

A blind peer-to-peer order pool flips all three dynamics. No central corporate database collects your sales history, and no middleman skims a fee off every box. Participation is completely voluntary item by item: you can pool orders for paper towels while keeping specialty suppliers separate.

Preventing double orders when assistants negotiate at once

Once a group of local shops unlocks a combined bulk order, their software assistants can ask several wholesale distributors to bid for the business. That raises a practical coordination problem that every purchasing manager recognizes.

Suppose the buyer pool needs one hundred and twenty boxes of gloves, and the software contacts five regional wholesalers at once for quotes. What happens if three different wholesalers say yes at the exact same second? If every assistant locked in a binding contract immediately, the clinics would accidentally buy three hundred and sixty boxes, three times what they actually need.

Recent advances in automated procurement solve this over-commitment hazard cleanly.² Instead of placing binding purchase orders with five vendors simultaneously, the pool's assistant separates price discovery from final commitment.²

First, the software queries all five wholesalers in parallel for non-binding price quotes and delivery dates.² Next, it ranks the offers and locks in a binding agreement with one supplier at a time using a short expiration timer.² Once the top supplier confirms, the remaining inquiries close gracefully, preventing accidental double-ordering.

Staying squarely inside competition guardrails

Whenever independent businesses coordinate, responsible owners ask an important legal question: how do we make sure our buying pool complies with antitrust and competition laws?

Public competition authorities draw a clear, common-sense line between harmful seller cartels and helpful small-business buyer pools.³ When competing stores get together to fix the retail prices they charge the public, that harms families and violates the law. When small clinics or independent shops team up to buy wholesale inputs (like bandages, shipping cartons, or flour) that lowers costs and helps them compete against giant conglomerates.³

In fact, long-standing Department of Justice and Federal Trade Commission guidelines establish explicit antitrust safety zones for joint purchasing arrangements among healthcare providers and small businesses.³ Those public rules emphasize two key safeguards. The combined group should account for a modest share of the overall wholesale market.³ And participants must never use the buying pool to share downstream retail prices, wage data, or marketing plans.³

Blind cryptographic matching enforces those legal guardrails by design. Because the software only matches wholesale item codes and quantities inside sealed mathematical envelopes, participating shops literally cannot see each other's retail prices, customer lists, or operating margins. Technical privacy and legal compliance reinforce each other at every step.

How a neighbourhood can start a pool next month

Local businesses do not need to overhaul their accounting software or hire cryptographers to buy smarter together. A practical pilot starts small and builds trust step by step:

• Start with five universal staples. Pick everyday supplies that every shop on the street buys monthly and nobody competes over: printer paper, shipping cartons, takeout containers, nitrile gloves, or sidewalk salt.
• Partner with a trusted local anchor. Local credit unions, chambers of commerce, pharmacy associations, and rural hospital cooperatives make natural hosts. They can provide the open-source matching tool without holding private books.
• Set clear delivery and payment rules up front. Agree that the wholesaler will bill each business for its own share directly. Or hold each shop's payment in a credit-union escrow account when the threshold light turns green.

Healthy communities depend on independent shops, family farms, and clinics that answer to local residents. When small operators pool purchasing power without giving up privacy, they keep more of their hard-earned margin on main street.

1. Michael J. Freedman, Kobbi Nissim and Benny Pinkas, "Efficient Private Matching and Set Intersection," Advances in Cryptology – EUROCRYPT 2004, Lecture Notes in Computer Science, vol. 3027 (Springer, 2004), doi:10.1007/978-3-540-24676-3_1; and Le Yang and Weijing You, "Practical Traceable Over-Threshold Multi-Party Private Set Intersection" (2025), arXiv:2512.24652.

2. Xiaolin Xu and Donghao Zhu, "Parallelism or Concession? Concurrency-Aware Procurement Negotiation for Agentic Commerce" (2026), arXiv:2610.06017; and Jia Wang et al., "ProcureGym: A Multi-Agent Markov Game Framework for Modeling National Volume-based Drug Procurement" (2026), arXiv:2603.23880.

3. U.S. Department of Justice and Federal Trade Commission, "Statements of Antitrust Enforcement Policy in Health Care," Statement 7: Provider Participation in Joint Purchasing Arrangements (1996), ftc.gov/enforcement/competition-guidance/health-care-guidance/statements-antitrust-enforcement-policy-health-care.