Technical and organisational measures

Tenant isolation

Each customer's data is separated at the database with PostgreSQL row level security, which is enforced for the application's own role, and the signed-in organisation is set on every request and job. Application code also scopes every query to the organisation.

Encryption

Traffic is encrypted in transit with TLS and HSTS. Sensitive fields are encrypted at rest by the application before they reach the database: free-text survey and ritual responses, reflections and comments, demographic fields (gender, ethnicity), and the credentials of HRIS, Slack, Teams and single sign-on integrations. Encryption keys are held in application credentials, not in the database.

Authentication and access

Passwords are stored as bcrypt hashes and API keys as one-way hashes. Single sign-on through Google or Okta is available. Access follows four roles (organisation admin, HR admin, manager, employee), each limited by explicit authorisation policies, and public actions are an explicit allowlist.

Anonymity threshold

Survey results are shown only as aggregates of 5 or more responses. Smaller groups are not displayed, so a manager cannot identify a respondent.

Audit log

Administrative and compliance actions are written to an append-only audit log. The database refuses edits to existing entries, and deletion is refused outside a controlled purge. Demographic, pay band, token, secret and password fields are redacted by name before an entry is stored.

Whistleblowing channel

Reports are restricted to the people the organisation designates. A scheduled retention job removes reports that are not investigated after 3 months and closed cases after the organisation's retention period (at most 10 years), keeping only an anonymised count.

Application security

A content security policy and strict parameter filtering are enforced in the application. Static analysis (Brakeman), dependency auditing (bundler-audit) and JavaScript dependency auditing run on every change in continuous integration.

Network edge

Traffic passes through Cloudflare, which provides the CDN, proxy and DDoS protection. The application restores the visitor address only from Cloudflare's published ranges.

Minimisation and deletion

Raw survey responses are deleted automatically after 24 months, and usage and security logs are kept for up to 90 days. See the retention schedule in the privacy policy for the full list.

Breach notification commitment

If we become aware of a personal data breach affecting data we process for you, we will notify your designated contact within 48 hours of becoming aware of it.

The notification will state, as far as known: the nature of the breach and the data and people concerned, the likely consequences, the measures taken or proposed, and the contact point for questions. We will send updates as more is established and support your own notification to the supervisory authority.