A first computing device connected to an internal network de-anonymizes data. A record including a surrogate key is received from a second computing device connected to an external network to the internal network. Each identity data record includes a second surrogate key, an entity identifier field value, a record type field value, and a de-identified field value. The second surrogate key uniquely identifies the respective record. The surrogate key is compared to the second surrogate key to identify a matching record. The matching entity identifier field value is selected and compared to the entity identifier field value of the plurality of records to identify a master record for the surrogate key. The record type field value includes an indicator indicating whether the record is the master record. The de-identified field value included in the identified master record is selected. The received record is supplemented with the selected de-identified field value.