How we maintain trust with you and your employees.

Here is how employee answers are protected, who can access what, and where we stand on certification. We say what is verified and what is policy.

Assurance

Independent assurance

We are preparing for SOC 2 and ISO 27001. Many of the controls those audits examine, such as role-based access, audit trails, encrypted connections and verified backups, are already built into the product, and we can walk your security reviewer through them today. We do not yet hold a certificate, and we will not claim one until we do.

Residency

Where your data lives

Hosted in Australia. Other regions, such as the EU or US, available on request. Error reports go to a service in the US. They carry an organisation id and nothing from any survey answer: no answer text, no names, no emails.

Answers

Who can see individual answers

Nobody in your organisation. Individual survey answers are recorded and hidden from everyone, including admins. Suggestions and comments are shown only to the roles you allow, and never with the writer's name. If a role is allowed to moderate comments, every moderation action is recorded with who did it.

Groups

How small groups are protected

A group's results are hidden when fewer people answered than a minimum set by the published survey rules. You can raise that minimum. You cannot lower it. Extra rules reduce the chance of working out a hidden group from the groups that are shown. The same rules apply to onboarding and exit surveys. A benchmark number appears only when enough people and enough organisations are behind it. These rules reduce the risk of identifying someone. They cannot remove it across every combination of views you allow, and we say so.

Access

Access and roles

Access is by role. Every permission is declared in the product. Access can be limited to a business unit or a team. Sign-in runs through WorkOS, which supports single sign-on, and directory sync keeps your member list up to date.

Encryption

Connections to the database require TLS. Credentials for your people-data sources are stored encrypted. Encryption at rest is provided by the hosting platform; ask us for the current statement for your deployment.

AI processing

Employee answers go to an AI model only under a recorded policy. The policy names the provider, where the data goes and who decided. Where a third-party model is used, it is set to keep nothing and train on nothing. Australian-only AI is available on request. On that path the cloud account's settings govern retention. The product does not log prompt content.

Deletion

Removing your data

Deleting an organisation goes through one controlled path. It deletes that organisation's data from our database and nothing else, keeping only the records we must retain as evidence. Backups age out on their schedule. A full export is agreed in the contract.

An administrator can permanently erase one comment when the person who wrote it asks, or when it contains sensitive information. The comment's words are replaced and the rest of the response is kept. A comment in a group too small to be shown cannot be erased this way. Copies already exported, and backups until they expire, are not erased.

This website

This website sets no cookies. The only thing it keeps in your browser is the light-or-dark choice you make with the switch at the top. We use cookieless analytics to understand how the site is used, and the demo page uses a bot check. Our Privacy Policy explains what they receive.

Contact

Security questions

Security questions, bug reports and supplier forms: [email protected].