Privacy is baked into the architecture
At PulseFlow, privacy is not a compliance checkbox or a legal disclaimer — it is the technical foundation of our platform. We believe the only meaningful anonymity guarantee is one that survives even insider access.
This means we don't simply mark data as anonymous. We architect the system so that the link between an employee's identity and their feedback cannot exist in our database — not as a record, not as a log, not as anything that can be reversed.
Rule-of-5 Minimum Cohort Redaction
In small teams, responses can be deduced by elimination. If a team of four submits a survey, and scores for that group are shown, any team member could potentially infer which specific response came from which colleague — even without seeing named data.
PulseFlow enforces a hardcoded minimum threshold of N ≥ 5 respondents. If a filter yields fewer than 5 responses, all score distributions, sentiment metrics, and verbatim comments for that segment are automatically suppressed.
Suppressed responses are not discarded — they are still included in higher-level, company-wide aggregations where the cohort exceeds five respondents, ensuring no feedback is lost while keeping individuals protected.
Response Decoupling
Standard survey platforms store user identifiers (email, user ID) and survey responses in the same database row, then set a flag like is_anonymous = true. This offers no real protection — any database administrator with direct access can bypass that flag.
PulseFlow uses a fundamentally different approach. Identity tokens and feedback payloads are processed in separate execution paths:
By the time feedback is persisted, there is no record that connects it to any person — not even in system logs, not even in encrypted form.
Data Ownership & Zero Commercialization
Your organization owns all aggregated workspace data collected through PulseFlow. We act as a data processor only — you are the controller.
PulseFlow does not sell, rent, license, or share client feedback with any third party. We do not use your employees' responses to train public AI large language models, benchmark studies, or any commercial product — under any circumstances, including after contract termination.
Encryption standards: TLS 1.3 with HSTS for all data in transit, and AES-256 with tenant-isolated keys and automated rotation for data at rest.
GDPR & Privacy-by-Design
Our architecture is designed around GDPR Article 25 (Data Protection by Design and by Default). This means:
Data minimization: We collect only what is necessary for the survey to function. Authentication records are transient and kept for the minimum time required to prevent duplicate submissions.
Purpose limitation: Employee feedback is used only for the analytics purpose disclosed to respondents — never repurposed for advertising, profiling, or AI training.
Right to erasure: Employees can request deletion of authentication records. Because feedback payloads are already decoupled from identity, there are no personal data records in the feedback database to delete.
Security & privacy contacts
For DPA requests, vendor security questionnaires, or any privacy-related queries, reach our team directly.