Built so that reporting cannot become surveillance

Privacy commitment

• No keylogging
• No screenshots
• No individual productivity rankings
• No automated performance classification
• No medical or psychological diagnosis
• No discipline recommendations

Tenant isolation

Each organization's data is logically isolated. All reads and writes for organization, team, and cycle data are scoped to the requesting organization; there is no cross-tenant query path in the application layer.

Row-level security

Database access is enforced with row-level security policies, not solely by application logic. Every table that stores diagnostic responses, scores, or member data carries policies tied to organization membership and role, so a bug in one layer does not expose another tenant's data.

Aggregate-only reporting

Team-level reports show condition scores computed across the group, never individual answers. Scoring happens server-side; individual responses are never sent to a browser in a form that could be re-identified.

Hard minimum of five completed, non-leader participants

A team report will not compute or display until at least five non-leader participants have completed the diagnostic. This threshold is enforced server-side and cannot be overridden by an administrator or leader. Below the threshold, no aggregate view is produced.

Leader responses kept separate

A team leader's own responses are scored and reported separately from the team's aggregate, specifically so the leader's perception can be compared against the team's without either being able to infer an individual team member's answer.

No open-text comments

The diagnostic collects only structured, closed-ended responses on a fixed agreement scale. There is no free-text comment field anywhere in the instrument, which removes an entire class of re-identification and sentiment-mining risk.

Server-side scoring

All scoring — condition means, dispersion, leader-gap calculations, and Binding Constraint selection — runs on the server against the versioned scoring configuration. Clients never receive enough raw data to recompute an individual result.

Audit events

Sensitive actions — account registration, legal acceptances, cycle launches, and administrative changes — are recorded as audit events with actor, action, target, and timestamp, so organizations and BrainEng can review who did what.