Security & trust

The anonymity model

Anonymity in StaffVoice is enforced by the database schema, not by access rules that could be misconfigured:

• Invitation emails and responses are stored in tables with no foreign key between them — there is no query that joins who was invited to what was written. Reminders work through an anonymous ping that carries no response content.
• Managers never see raw notes. No authenticated screen queries the raw notes table; managers get only the AI-rewritten responses and the report.
• Raw notes are deleted at most 30 days after a pulse closes. Organizations can shorten this window, never lengthen it.
• Reports never reveal how many respondents signed their name versus stayed anonymous.
• A pulse cannot be closed early — the response window your team was promised always holds, so nobody can close after one response and read a near-identifiable report.

We're equally clear about the limits: anonymous means a respondent's name isn't attached. A manager may still recognize details a respondent includes, and the response page says exactly that to every respondent.

Authentication

• Passwordless sign-in: email magic links (15-minute expiry), Google, or Microsoft. No passwords stored, ever.
• Optional two-factor authentication (TOTP) with hashed recovery codes, and org-wide 2FA enforcement for teams that require it.
• Enterprise single sign-on (OIDC) is available on request.

Data handling

• All traffic is encrypted in transit (TLS).
• Data is stored in managed infrastructure (Vercel, Neon Postgres) with encryption at rest.
• Respondents need no account: response links carry a token whose hash — never the token itself — is stored server-side.
• Payment card data never touches our servers — payments run entirely through Stripe.

The full list of sub-processors and our data-protection commitments are in the privacy policy and Data Processing Addendum.

Reporting a vulnerability

If you find a security issue, email [email protected] and we'll respond quickly. Please give us reasonable time to fix an issue before disclosing it publicly; we won't take action against good-faith research that respects users' data.