Privacy Policy

How PulseFlow protects your people

This document describes our privacy principles and the technical architecture behind PulseFlow's anonymity guarantees. No legal jargon — just how it actually works.

Last updated: August 2026

Overview

Privacy is baked into the architecture

At PulseFlow, privacy is not a compliance checkbox or a legal disclaimer — it is the technical foundation of our platform. We believe the only meaningful anonymity guarantee is one that survives even insider access.

This means we don't simply mark data as anonymous. We architect the system so that the link between an employee's identity and their feedback cannot exist in our database — not as a record, not as a log, not as anything that can be reversed.

Looking for the full technical spec?
Our Security & Compliance Hub includes interactive live demos of Rule-of-5 redaction, architectural diagrams of response decoupling, and the complete enterprise control matrix.
01
Rule-of-5 Redaction
Any segment with under 5 respondents is automatically suppressed — scores, comments, and distributions alike.
02
Response Decoupling
Identity tokens are purged at the API proxy in memory before feedback reaches any persistent database.
03
Zero Data Commercialization
Your employees' responses are never sold, rented, or used to train public AI models.
04
GDPR Privacy-by-Design
Data minimization, purpose limitation, and right-to-erasure are enforced architecturally — not just contractually.
01 — Anonymity Protection

Rule-of-5 Minimum Cohort Redaction

In small teams, responses can be deduced by elimination. If a team of four submits a survey, and scores for that group are shown, any team member could potentially infer which specific response came from which colleague — even without seeing named data.

PulseFlow enforces a hardcoded minimum threshold of N ≥ 5 respondents. If a filter yields fewer than 5 responses, all score distributions, sentiment metrics, and verbatim comments for that segment are automatically suppressed.

No admin override exists
HR Super-Admins and executive roles have no mechanism to lower or bypass this threshold. It is enforced at the aggregation layer, not as a UI permission setting.

Suppressed responses are not discarded — they are still included in higher-level, company-wide aggregations where the cohort exceeds five respondents, ensuring no feedback is lost while keeping individuals protected.

02 — Zero-Trace Ingestion

Response Decoupling

Standard survey platforms store user identifiers (email, user ID) and survey responses in the same database row, then set a flag like is_anonymous = true. This offers no real protection — any database administrator with direct access can bypass that flag.

PulseFlow uses a fundamentally different approach. Identity tokens and feedback payloads are processed in separate execution paths:

Edge Proxy Validation
The auth token is validated at the API proxy to prevent duplicates — without writing any identity to logs or database.
Identity Purge in Memory
Token, IP address, and all request metadata are stripped in volatile proxy memory before the payload moves forward.
Anonymous Persistence
Only the encrypted, isolated feedback vector reaches storage. There is no foreign key to join, no metadata to cross-reference.

By the time feedback is persisted, there is no record that connects it to any person — not even in system logs, not even in encrypted form.

03 — Ownership & Ethics

Data Ownership & Zero Commercialization

Your organization owns all aggregated workspace data collected through PulseFlow. We act as a data processor only — you are the controller.

PulseFlow does not sell, rent, license, or share client feedback with any third party. We do not use your employees' responses to train public AI large language models, benchmark studies, or any commercial product — under any circumstances, including after contract termination.

Encryption standards: TLS 1.3 with HSTS for all data in transit, and AES-256 with tenant-isolated keys and automated rotation for data at rest.

04 — Regulatory Alignment

GDPR & Privacy-by-Design

Our architecture is designed around GDPR Article 25 (Data Protection by Design and by Default). This means:

Data minimization: We collect only what is necessary for the survey to function. Authentication records are transient and kept for the minimum time required to prevent duplicate submissions.

Purpose limitation: Employee feedback is used only for the analytics purpose disclosed to respondents — never repurposed for advertising, profiling, or AI training.

Right to erasure: Employees can request deletion of authentication records. Because feedback payloads are already decoupled from identity, there are no personal data records in the feedback database to delete.

05 — Contact

Security & privacy contacts

For DPA requests, vendor security questionnaires, or any privacy-related queries, reach our team directly.

Security & Privacy Team
Send us a message
For DPA requests, security assessments, or any questions about our data handling practices. We respond within 24 hours.
sidharth.technologies@gmail.com View full Security & Compliance hub