An organization is collaborating with multiple external vendors and wants to share only anonymized, aggregated user behavior data for analysis. They need a method that will prevent vendors from downloading the raw data but will allow them to access updated aggregates and perform limited analyses. Which solution should the organization use?