Who can see your answers and results?

Team members and raters

Their own answers, while the survey is open, through their personal link. Afterwards, their own individual note, which a facilitator the team has named can also read. Nothing about anyone else as an individual.

The team lead

The roster, who has started and who has submitted, by name, so they can nudge anyone who has not — once per person in a run — and the shared team pack once released. No answers, no individual peer scores, no individual notes, no written comments. Leading the team does not give access to any of them.

A facilitator, when one is attached

Everything the lead sees, plus every member’s individual note, before and after release, for as long as they hold the role. The facilitator view also names raters beside patterns in how they rated (for example, giving everyone the same score) and notes where one person rates another unusually. It never shows ratings or comments as written. If the facilitator was named before anyone agreed to take part, it includes a paraphrase of each written comment, without the writer’s name. An owner or admin names the facilitator, and a manager or an admin can be appointed. A facilitator exists to put a human between a machine-written report and a person reading it about themselves.

The workspace’s owners and admins

On every team in the workspace, what the team lead sees: the roster, who has started and who has submitted, and each team pack once it is released. No answers, no individual peer scores, no individual notes, no written comments. Where an owner turns the program report on, the workspace’s owners, and a practitioner the organization has engaged, also read a program report: numbers pooled across at least three teams, with each team named only for who took part and what it decided, and only from surveys whose people were told before they answered.

Owner and admin are roles in the workspace, not a manager’s capacity: what the row on managers and HR below says stands as written.

A practitioner your workspace engaged

A practitioner your workspace engaged sees what an admin sees, and the teams they facilitate as a facilitator does; their access is in the access log and ends when the engagement does.

The person a Leadership 360 is about

Their own brief, once it is released. On each behavior, the average of what the people who answered said, beside their own rating and the rating they expected, wherever at least 3 people observed it. The average for each question, and for the overall questions beside their own answer, only where at least 5 people answered it. The comments as paraphrased themes. It never shows who gave which answer or any one person’s ratings, and never the confidential box for the facilitator. Where the workspace’s program report was on when a leadership review opened, and its people were told so before they answered, its numbers also reach the workspace’s owners and a practitioner the organization has engaged, only pooled with other leaders’ in cohorts of five, once a cohort is complete, never naming whose numbers are whose.

A Leadership 360 someone set up for you

Someone who may start a review in a workspace (an owner or admin, a practitioner the organization has engaged, or a manager the workspace has given a seat, so possibly your own manager) can set one up for you by your address. It runs only if you accept it, on a page that says first that, as its facilitator, they will read who was asked and who has answered, anything written in the confidential box, and your brief before you do. You may decline, and nothing is sent to anyone until you accept. They never see anyone’s answers, and your self-assessment, your goals and what you share stay yours.

Managers and HR

Nothing from the feedback side, in that capacity. A manager who is also a member of the team gets exactly what every other member gets, and nothing more. No manager role, setting or export hands a manager another person’s peer ratings or individual note. The one way to that access is being appointed the team’s facilitator, as above. A manager can also set up a Leadership 360 for one of their reports and be its facilitator, as the 360 section above describes: it runs only if the person accepts it, knowing what the manager will read, and they may decline.

The manager tools are a different matter and are covered below: there a manager records goals, bands and written assessments about named people, and those records are theirs to read and to export. They contain nothing from the feedback side, apart from a summary a 360’s subject chooses to send, described below.

A manager, in an engagement cycle

An engagement cycle is an organization-wide survey, not feedback about anyone. A manager sees their own group’s numbers and the organization total, once the group clears the reporting floor, only for cycles that said so before anyone answered; never an individual answer, anyone’s words or another group. The consent page tells each person their manager will see their group’s numbers, and the setting cannot change once the cycle has opened. Which group is a manager’s is decided by the account the workspace’s roster ties them to, never by a name that resembles theirs, and each time a manager opens their group’s results it is written to the audit log.

Change since the last engagement cycle

A cycle’s results can show how a group moved since the organization’s last cycle, and only between two numbers the reader could already see: the group’s figure as each cycle published it, and, for a manager, only where both cycles told the people answering that their manager would see their group. The change is worked out from those two published numbers and nothing else, never from anyone’s answers or from who answered both times, and only where most of the same people were invited both times.

Conversation records

The manager who holds the conversation, and nobody else. They are not in the workspace export.

What the organization will try

The workspace’s owners and admins, on the cycle’s page and in the workspace export; never a manager.

Options for a manager’s group

The manager whose group it is, and nobody else; not in the workspace export.

An HR system or identity provider, when one is connected

An owner can connect the organization’s identity provider, or an HR system through it, to keep the engagement roster. For each person it sends, we keep their name, work email address, manager, department, whether they are active and their end date, with the identifiers it uses for them; nothing else it sends, such as a job title, location or pay, is kept, and nothing is ever written back to it. Only an owner can connect, stop or replace one. What it says reaches the roster when an owner or admin applies it, or each hour on its own where an owner has turned that on; managers see none of it. Someone it marks as having left is not invited again once that is applied, and their roster row is deleted 90 days after they were marked inactive.

A manager whose work email address it gives as someone’s manager is shown those people’s names on their People page, and they become people the manager keeps only if the manager presses to add them. Nothing else from it reaches a manager, and no survey figure ever does.

The manager

The records they keep for the people they lead: goals, quarterly performance bands, 1:1 notes, colleague input and assessments. Another manager’s records are not theirs to see: to a manager, another manager’s person looks exactly like a person who does not exist. The one way past that rule is deliberate and visible — an owner or admin of the workspace can open a record to read it, never to change it, and every open is logged with their name and the date and shown to the manager who keeps the record.

If a manager turns it on, the people they keep 1:1s with can add topics for those 1:1s, and the manager reads them on the 1:1 pages, with the person’s name on them, and cannot change them. An owner’s or admin’s open of a record does not show them.

Your manager may note the hours a week you work. It is shown to them and to you, used to show how full your coming weeks are against the work planned and estimated for you and, added up with the hours of the other people they track, how full their team is, and used for nothing else. If your manager connects Microsoft Power BI, the figure is sent there too, with the rest of what they see. Your manager may see, beside their notes and when preparing a 1:1, how full your coming weeks are as a percentage and a word, computed when the page is read and stored nowhere in Facets; if your manager connects Microsoft Power BI, these figures are sent there too.

The person being assessed

There is no in-app view for them yet, which is a gap rather than a feature. The assessment exports as a document written to be handed over — fairness notes first, the rationale beside the band, and a closing line naming what fed it. Separately: in most places a written characterization of an employee is personal data that person can ask to see, and the app says so wherever a manager types about someone.

The one thing they can do, if their manager turns it on, is add topics for their 1:1s through a personal link. There they read their own topics and the date of their next 1:1, and nothing of the manager’s record. They never pay, sign in or need an account for it, and no model is given what they write.

Growth and stay conversations

A manager can record a growth conversation, about where someone wants to grow, and a stay conversation, about what keeps them and what would make their work better: what the person said, in their words, and the guide the conversation was held against. They are part of the person’s record, seen as the rest of it is and downloaded with it. Nothing here is rated, and nothing here is read when an assessment is drafted or a message is written in Drafts. A stay conversation records what was said, never a conclusion about whether the person will leave: there is no field for one.

Colleagues who are asked for input

They are told, in bold, before they type: their manager will read what they write, with their name on it, and will use it when writing this person’s assessment. There is no anonymity offered here, because with two or three respondents it could not be delivered. Declining is a real button, the manager learns only that somebody declined, and any half-written draft is discarded.

Teammates on an idea board

An idea board is a manager asking their team one question and reading what comes back, and it has privacy settings of its own rather than borrowing either set above. Each board carries one of four settings for names, chosen before anybody posts and fixed from that moment: hidden from teammates but seen by the manager; hidden from everyone, the manager included; shown to everyone; or each person’s own choice, post by post, which is the default. People write under the setting they were shown, which is the reason it cannot be changed underneath them afterwards.

On the setting that hides names from everyone, it is the database that withholds them. Who wrote what is kept in its own table, and the rule admitting a manager to that table does not hold for such a board — so the manager, the logged admin path and the export all get no rows at all, rather than a page that knows the answer and declines to show it.

Votes and reactions are counts under every one of the four settings. Nobody sees who voted, the manager included, and there is no setting that changes it. An owner or admin can open a board to read it by the same logged path they open a People record by, with their name and the date recorded and shown to the manager who runs it.

A board can also be a whiteboard, and the same rules hold on it, because a sticky note is an idea: the words on it are one row in one table, under the same names setting, the same export, the same withdrawal and the same purge. What a canvas adds is where things are, and that is where the line falls. This board also has a canvas. Where you put a sticky note is something everyone on the board can see; when you put it there is not shown. On a small board, how you arrange things may still say who you are. Live cursors and the pen are offered only on a board that shows every name, because a pointer with a name on it says who is here, an unlabeled one says it by elimination, and a count of who is present says the same thing more slowly. On every other setting the board refreshes while people read it without saying who is there.

Pictures can be uploaded to a canvas, and everyone on the board and the manager can see them. Every upload is re-encoded on the way in, so no camera, location or editing metadata survives; what that cannot remove is what is in the picture, so the board says before anybody uploads one that a picture can show a face or a name and that the choice is theirs. They are stored privately on the same infrastructure as everything else here, reachable only through a link to the board that holds them, and both the files and their records go with the board’s words on the ninety-day clock.

If the manager has switched GIFs on, GIPHY’s published API rules require the search and the image load to happen in the browser. So the picker searches GIPHY from the browser of the person using it, and the browser of anyone whose page shows a GIF looks it up and loads it from GIPHY directly. GIPHY gets that browser’s IP address, the ordinary browser details, the words somebody typed and the ids of the GIFs looked up — and never a name, an email address, an account or board identifier, or the address of the page. Searches and the GIFs shown are rated G, and the board’s promise page names GIPHY and the IP address before anybody posts.

A manager can open a board with theme suggestions switched on, and the board’s promise page and invitation say so before anybody posts; like the names setting, it cannot change afterwards. On such a board the manager can ask an AI model to suggest themes that group the ideas everyone on the board can see. The model is sent each idea’s title and the words under it, never who wrote it, and on an inbox board or before a reveal it is sent nothing. The themes are shown to the manager alone and move nothing on the board.

Nothing on a board is part of any performance record. No board table references a People record in either direction, so an idea cannot become a goal, a line in a check-in, or evidence in an assessment; a manager who wants to act on one copies the words across by hand, into their own.

Teammates on a project

A project is a task tracker, and it has terms of its own rather than borrowing any of the three above — because it cannot honestly borrow one. A task has an assignee; a manager who watches a late task list has learned something and will not unlearn it. So the project says plainly what it is, in the same weight of type as the others, on its own first screen and before anybody writes anything: Everyone on this project sees names — the manager who runs it, and every teammate on it. It is a record of work, not of feedback about anyone. Nothing here is copied into any assessment, and nothing here is anonymous.

There is no names setting on a project and there is nothing to withhold: who a task belongs to and who wrote a comment are columns on the row, shown to everyone on the project. Nothing here is anonymous, and nothing here can be. If you want to raise something without your name on it, an idea board is the place for that, not a task.

The manager who runs a project can edit any task, because a task is an instruction about work. They cannot edit a comment somebody else wrote — that is testimony, and the only thing they can do with it is delete it with a reason its author can read. An owner or admin of the workspace can open a project by the same logged path they open a People record by, with their name and the date recorded and shown to the manager who runs it. Nothing anyone writes on a project — a task, an estimate, a comment, a date — is part of any performance record, and no project table references a People record or the reverse. One kind of figure crosses: hours. Where your manager tracks you in Facets and you share the address you were invited by, they may see the hours of estimated open work you hold on any project in this workspace, week by week and by project, and the hours a week any manager has planned for you; not the tasks, comments or anything else on a project they do not run.

A manager can turn an idea from a board into a task on a project. When they do, the words are copied across rather than linked, and whether the project is told where the task came from depends on the board it came from: the line From an idea on {board} is shown to members only on a board that shows every name. On any other board they see nothing about the idea, because “this task came from that idea, and it is assigned to Priya” would say that Priya wrote the idea. The manager, who made the task, always sees the link.

Anyone who can change a task can attach a web address or a picture to it, and everyone on the project and the manager can see both. Pictures are re-encoded on the way in, so no camera, location or editing metadata survives; what that cannot remove is what is in the picture, so the project’s first screen says before anybody uploads one that a picture can show a face or a name and that the choice is theirs. A picture can be deleted by the person who uploaded it and by the manager. Pictures are stored privately on the same infrastructure as everything else here, reachable only through the project’s own pages — an owner or admin who opens a project by the logged path is told how many there are and is not shown them — and deleting a project deletes every picture on it. Ninety days after a workspace stops paying, the pictures teammates uploaded to its tasks are deleted with their comments. The manager's own pictures and every link stay with the task, as its description does.

A manager can write updates about how a project is going and send them by email to people outside the project whom they name, typing a name and an email address for each: everyone on the project sees those names and never the addresses, an update carries counts and dates and never a comment or a figure about one person, and every update email carries a link that stops them. Anyone holding the project’s read-only link, which the manager can switch on and off, reads its updates, its milestones, and the title, status and due date of each open task, and nothing else.

A manager sees, for each person on a project, the hours of estimated open work they hold in each coming week, and each person sees the team's total and their own; a figure about one person is shown to the manager and that person, and leaves the project only as hours per week, to the manager who tracks that person in Facets.

A manager may note the days each person on a project is away, and each person may note their own; the manager and that person see them and nobody else, and the schedule plans around them. A manager may also turn on planning around each person's weekly capacity for a project; the dates a schedule then sets can reflect how many days a week each person works, and the promise page says so to everyone on the project. A saved baseline keeps each task's dates as they were on one day, and everyone on the project sees it.

A manager can set goals of their own that tasks on their projects count toward; a goal may name an owner, who is shown to everyone on those projects, as a task's owner is. A goal is the manager's, counted from tasks, and is not a goal on anybody's People record.

A manager can connect a Slack or Microsoft Teams channel of their own to a project or an idea board. What is posted there is what everyone on the project or board can already see: an update, a daily list of tasks done, due and overdue with their owners, a board's opening and closing, and ideas without names. It never carries a comment, a vote, an estimate or a figure about one person. It is a copy in the customer's own service, and the ninety-day deletion does not reach it. A manager can also connect a channel of their own for reminders: how many check-ins are due, and that their group's survey results are ready or a commitment's check is due, with no figure and no name. An organization can connect a channel to a survey cycle, told that the survey is open or closing and nothing about who answered.

A manager can connect their own Microsoft 365 work account and send tasks from a project to a Microsoft Planner plan in their organization. What is sent is what everyone on the project already sees of that task: its title, description, dates, priority, checklist and labels, and who it is assigned to, matched to a Microsoft 365 account the manager picks. We keep the manager's Microsoft sign-in, sealed, to send tasks and to learn whether each one is complete. We keep no Microsoft address and read nothing else from Planner. Survey answers, Leadership 360 answers and People records never go. What was sent is a copy in the customer's own Microsoft 365, and the ninety-day deletion does not reach it.

A manager may plan the hours a week a person spends on a project they run, or on work tracked elsewhere, for people on their projects and people they track; the people who plan for you and you see those hours, and so does a manager who tracks you in Facets, with the project's name and who planned it; nobody else on a project does.

A manager may let Microsoft Power BI read, under a key only they hold, what they themselves see of their projects and of this planning: names and never addresses, no comment and no survey answer, and of a People record only a tracked person's name and the hours a week noted for them. Replacing the key ends the old one at once.

Us, and HR

There is no HR role and no organization-wide view on a single manager plan. On the Organization plan, owners and admins can open any manager’s record through the logged path above; there is still no export of everyone at once and no view that reads across records without opening each one. Our own operator console can reach account and billing metadata and is blocked at the column level from every table on this side — assessments, goals, colleague input and the rest — with a test that fails if a new table is added without someone deciding which side of that line it is on, run in continuous integration on pull requests marked ready for review and on changes to the main branch.