PulseFlow doesn't ask employees to trust a policy. We bake anonymity into the architecture itself — through Rule-of-5 Redaction and Response Decoupling — so even we can't trace who said what.
Privacy guarantees that survive even insider access — because the data architecture makes re-identification mathematically impossible.
In small teams, responses can be reverse-engineered by elimination. PulseFlow's aggregation layer enforces a hardcoded minimum of N ≥ 5 respondents before any metrics are surfaced.
Automated suppression — scores, sentiment, and verbatim comments are all withheld for any cohort under the threshold.
Zero admin override — HR Super-Admins and executives have no mechanism to lower or bypass the N=5 guardrail.
Cross-filter defense — combining multiple filters (Department + Tenure + Location) recalculates cohort size in real-time before any data is shown.
Standard surveys store user emails next to responses in the same database row. PulseFlow separates identity from payload at the API boundary — before anything is written to disk.
user_id and response in the same row, then set is_anonymous = true. That flag can be queried away by any DB admin with direct access.A full breakdown of PulseFlow's technical controls, encryption standards, and data handling protocols for enterprise evaluation.
| Security Domain | Technical Standard | Protection Assurance |
|---|---|---|
| Data in Transit | TLS 1.3 / HSTS · 4096-bit RSA | All traffic between clients, proxies, and databases is encrypted with TLS 1.3 and Perfect Forward Secrecy. HTTP connections are rejected. |
| Data at Rest | AES-256 · Tenant key isolation | Storage disks, backups, and log streams are AES-256 encrypted. Each client's data uses isolated tenant keys with automated rotation. |
| Respondent Anonymity | Rule-of-5 · Decoupled proxies | Hardcoded N=5 threshold. Identity tokens are purged in volatile proxy memory before any payload reaches persistent storage. |
| GDPR Alignment | Article 25 Privacy-by-Design | Data minimization and purpose limitation enforced architecturally. Auth records kept minimal and transient per right-to-erasure obligations. |
| Data Commercialization | Zero monetization policy | Client feedback is never sold, rented, or licensed. We do not train public AI LLMs on your employees' responses — under any circumstances. |
| Security Contact | sidharth.technologies@gmail.com | Direct channel for DPA requests, vendor security assessments, and vulnerability disclosure. Responses within 24 hours. |
Questions we hear from HR leaders, IT security teams, and enterprise procurement — answered plainly.
is_anonymous = true. Any DBA can bypass that flag. PulseFlow's decoupling strips identity headers in volatile memory before payload persistence — there is no record to undelete.