How Facets protects your data.

Administrative access to production is limited to named operator accounts, controlled by an allowlist in the deployment configuration together with a roster we can revoke immediately. Each must also pass a one-time code from an authenticator app. Every access to a released report is logged.

Row-level security is enabled on every table. The tables holding raw ratings, comments and self-assessments have no read policy for any signed-in account at all — they are reachable only by server code holding a service credential, and only after it has verified a single-use participant token or a staff role.

The operator console is blocked at the column level from manager-side records — assessments, goals, 1:1 notes, colleague input — and from what teams write on idea boards and projects. A test fails when a new table is added and nobody has decided which side of that line it belongs on; it runs in continuous integration on pull requests marked ready for review and on changes to the main branch.

Participant links are single-use, randomly generated, and stored only as a one-way hash, so an existing link cannot be looked up or read back by anyone, including us. A lost link is re-issued, which stops the old one at once. On idea boards and projects, every other email that carries a new link — a reminder, a digest, an answer to an idea — leaves the one before it working for up to a day, so a page already open outlasts the email; a survey or rater link stops the moment a new one is issued. An engagement survey’s links are the exception: the link in the first invitation keeps working until the survey closes, alongside the link in the latest reminder, and a link from a reminder in between stops when the next one is sent.

The one exception is a shared open link: the single link that can be switched on for an idea board, a project or a leadership review so that a whole team can join by it. So that it can be copied again later, it may be kept as the link itself, not only as a hash, while it is switched on, and it is shown only to the person who switched it on — not to the team, not to a workspace admin, and not in our operator console. That copy is encrypted, as Infrastructure above describes. It is deleted the moment it is switched off or replaced, when a review’s link reaches its limit, or when its board, project or review closes. Personal links are never kept.

A personal calendar link is a personal link too: stored only as a one-way hash, so it appears once, when it is made. Anyone signed in can make one so that a calendar app they choose, such as Outlook, can fetch their own dates and titles, including the names of the people they manage. Getting a new link ends the old one at once, with no grace period, because a calendar link is replaced when it has leaked; turning it off ends it the same way.

A manager may connect Microsoft Power BI to a read-only feed of what they themselves see. Its key sits in the feed's address, is stored only as a one-way hash, appears once when it is made, and ends at once when it is replaced or stopped; each key may make up to 600 requests an hour.

Each connection, from Slack and Microsoft Teams to Entra ID, Okta and Power BI, is off until someone in your workspace turns it on. Connections lists what each one connects, who turns it on and what it can see.

Scoring is entirely deterministic. No model decides a number, a threshold, or whether a result is shown to anyone. Where a model is involved it writes narrative, drafts a project plan, a task breakdown or an update about a project for a manager to review, drafts the plan for a new project from what a manager describes, estimates for a project’s manager how long its tasks might take, or suggests themes that group an idea board’s ideas for its manager to read; who can see what sets out exactly what it receives in each case.

In the manager tools, a model also prepares, when a manager asks, a conversation guide, a 1:1 agenda, follow-up actions from their notes, measurable wording for a goal or a draft assessment for someone who reports to them, for the manager to review. When a manager’s AI credits are used up, and whenever model-written output is off or no AI provider is configured, each of the five answers from its standard template instead, and nothing is sent. It also adapts, when a manager asks, the guide to a growth or stay conversation to the person, from their role, the kind of work they do and what they said in the last such conversation; when the credits are used up, or model-written output is off, the guide’s own words are used and nothing is sent.

In Drafts, a model also writes a message a manager asks for, an email, a text or a chat message for them to send themselves, and checks how a message’s tone reads. Facets keeps no draft on the website and sends nothing on the manager’s behalf; in the iPhone and iPad app a finished draft or tone check is held, encrypted, for 24 hours so the app can collect it. Drafts has no template: when a manager’s AI credits are used up, and whenever model-written output is off or no AI provider is configured, it writes nothing, and nothing is sent.

The provider is Anthropic, whose commercial terms state that Anthropic may not train models on customer content from the services. Nothing written in Facets trains a model.

With no AI provider configured, a deterministic template writes the report instead, and writes a complete one. A customer who does not want a model near their data is asking for a supported configuration rather than an exception.

Theme suggestions on an idea board have no template behind them. They run only on a board opened with them switched on, which its team is told before anybody posts, and only when its manager asks; with no provider configured, or with model-written output turned off, there are none, and nothing stands in for them.