MedData Escrow

Researchers pay for medical data up front and find out later if it's bad. MedData Escrow has PayPal hold the money until the data proves it's what was promised.

Comment

Inspiration

I research ALS at UT Austin, and this fall my speech project stalled because of data. The public dataset had full recordings for only two patients with slurred speech, and one file we had turned out to be features only, with no audio. Buying data is worse, since you pay the vendor up front and only find out later whether the data is what they promised. Escrow already solves this for physical goods, where a third party holds the money until the package shows up. We wanted the same thing for research data, with AI doing the shopping.

What it does

  1. A researcher describes their study in plain English, and AI ranks every dataset in the catalog against it.
  2. A free sample gets checked for quality and privacy before any money moves.
  3. When they buy, PayPal authorizes the payment instead of charging it, so the money is held, not paid.
  4. The vendor delivers, and we audit the delivered data against what the listing promised (how many patients, how complete each column is, no information leaking from the future).
  5. If the data holds up, PayPal captures the payment and the vendor is paid out, minus a 10% platform fee. If it doesn't, the money stays held and a person decides. Software never settles a dispute on its own.
  6. After buying, the researcher can ask questions in plain English and gets back totals and averages only. Raw patient records never leave the vendor.

A researcher can also hand the whole job to an AI agent with a budget. It searches, checks samples, skips anything that fails, and opens an escrow order. The limits are in code, not the prompt, so it can't go over budget, skip the sample check, or release money.

How we built it

  • Next.js 16 and TypeScript for the UI and the API, with SQLite locally and PostgreSQL hosted.
  • PayPal Orders v2 (authorize, capture, void), Payouts, and signature-checked webhooks with dedupe, plus PayPal-Request-Id on every write so retries are safe.
  • Claude on Amazon Bedrock for ranking, turning questions into a query plan (the model never writes SQL), and the agent's tool loop. Every AI step has a rule-based fallback, and AI can only make privacy decisions stricter.
  • An escrow state machine (MATCHED, AUTHORIZED, DELIVERED, CAPTURED, PAID_OUT, plus dispute and void) with an audit trail of every step.
  • AG Grid for matches, the vendor order queue, the ledger and the catalog. Render hosts the live demo.
  • Spending mandates and an MCP server, so an outside agent can buy through PayPal escrow under the same limits.

Challenges

The biggest change came halfway through. We started with only a sample check, then asked what happens when the sample looks perfect and the delivery doesn't. With only a sample check, that vendor gets paid. So we built the delivery audit, and now payment depends on whether the delivered data matches the listing.

Our own tests kept catching us. The agent once bought a COPD dataset for an Alzheimer's study, so every guardrail moved out of the prompt and into code. Agent spending lived in memory and reset on restart, so it now gets reserved in the database before PayPal is ever called. Someone could recover a hidden small group by subtracting the other groups from the total, so the next smallest group is hidden too. And our first live deploy rejected every purchase because Render's proxy made our own site look like a different one. We caught that on the real site and fixed it.

Accomplishments

  • The whole escrow flow runs end to end, live on Render.
  • More than 1,000 tests, and evals with real numbers that CI holds us to. On honest data, the audit held the money 0 times out of 200. A scripted hostile model was blocked 26 times out of 26.
  • The evals found one of our checks flagging 97% of clean small datasets. It's around 2% now.

What we learned

An AI agent that spends money needs the same controls as a human buyer: a budget, a look before you buy, and a record of what it did. Those controls have to live where the model can't talk its way around them.

What's next

  • Run on PayPal's sandbox end to end, and turn on live Claude through Bedrock.
  • Real expiring download links (S3) in place of the mock link.
  • Test the audit on real, messy data with de-identified data partners.

Being honest about the demo

PayPal runs in mock mode for the demo so it never waits on a login. We've checked our sandbox credentials and created real sandbox orders, but approval, capture and payout are tested in mock mode only. Claude falls back to rule-based code because Bedrock access isn't on for our account yet. All patient data is synthetic.

Built With

Share this project:

Updates

Submission history