A method that includes one or more processing devices (108, 602) performing operations comprising: receiving a query, from a client computing device, for a sensitive database stored in a secured storage device that the client computing device is unauthorized to access, the sensitive database comprising a plurality of sensitive data records (302A, 302B, 302C, 302D, 302E), each sensitive data record having at least one sensitive attribute (304A, 304B, 304K) and a linking key, wherein the linking key uniquely identifies the sensitive data record and associates the sensitive database with a grouping database, wherein the grouping database comprises a plurality of grouping data records, wherein each grouping data record of the plurality of the grouping data records comprises a field for a grouping identifier and a linking key configured for linking the grouping data record to a sensitive data record of the plurality of sensitive data records having a same value for the linking key; identifying the linking key in the sensitive database; joining (206, 402) the sensitive database with the grouping database through the linking key; compressing the sensitive database by aggregating the plurality of sensitive data records into aggregation groups based on the grouping identifier; generating an aggregated database by calculating statistics for the at least one sensitive attribute of sensitive data records in each of the aggregation groups; inserting a trace link field in the aggregated database linking aggregated data records of the aggregated database to corresponding sensitive data records in the sensitive database, wherein the trace link field of an aggregated data record contains multiple trace links linking to respective multiple sensitive data records used to generate the aggregated data record; and causing the aggregated database to be accessible by the client computing device. receiving a query, from a client computing device, for a sensitive database stored in a secured storage device that the client computing device is unauthorized to access, the sensitive database comprising a plurality of sensitive data records (302A, 302B, 302C, 302D, 302E), each sensitive data record having at least one sensitive attribute (304A, 304B, 304K) and a linking key, wherein the linking key uniquely identifies the sensitive data record and associates the sensitive database with a grouping database, wherein the grouping database comprises a plurality of grouping data records, wherein each grouping data record of the plurality of the grouping data records comprises a field for a grouping identifier and a linking key configured for linking the grouping data record to a sensitive data record of the plurality of sensitive data records having a same value for the linking key; identifying the linking key in the sensitive database; joining (206, 402) the sensitive database with the grouping database through the linking key; compressing the sensitive database by aggregating the plurality of sensitive data records into aggregation groups based on the grouping identifier; generating an aggregated database by calculating statistics for the at least one sensitive attribute of sensitive data records in each of the aggregation groups; inserting a trace link field in the aggregated database linking aggregated data records of the aggregated database to corresponding sensitive data records in the sensitive database, wherein the trace link field of an aggregated data record contains multiple trace links linking to respective multiple sensitive data records used to generate the aggregated data record; and causing the aggregated database to be accessible by the client computing device.