What your company promises its people — and what we enforce for you

1. 1

   You can promise: their answers are theirs alone

   Tell your people, truthfully, that no manager, HR contact, or coworker — including you — can see how they personally responded. Not their scores, not their open answers, not even whether they completed a check-in on a given day.

2. 2

   You only ever see group patterns

   Everything your dashboard shows is aggregated — averages across teams of at least 5 people, never anything traceable to fewer. This isn't a policy we ask you to follow; it's enforced by how the data is computed, every time, with no exceptions and no override, not even for your own admin account.

3. 3

   You're not collecting names, and you don't have to protect them

   Nothing links an account to an identity beyond the email someone signs in with. There's no name field, no employee ID, no HR-system sync — nothing for your people to worry you're building a file on them.

4. 4

   Every account belongs to the person, not to you

   Anyone can delete their account and everything in it, permanently, with one tap, anytime — no request to your HR team, no waiting period. You're not the custodian of that decision; they are.

5. 5

   Small teams are protected automatically

   If a team is too small for anonymity — under 5 people — we simply don't show its results yet, even to you. Rather than lower the bar for a department you're curious about, we wait until there's enough people for the aggregate to protect everyone in it.

6. 6

   You know who's joined — never what they said

   You can see that someone you invited has joined ELEVANE and which team they're assigned to. That's the ceiling. Never what they answered, never whether they've completed a check-in, never anything they do inside the product.

"A private space to check in on how work is really going."

The exact words your people see, and agree to, before they answer a single question.

The technical honesty

No policy grants access — the path doesn't exist

Most privacy promises are policy: a rule someone agreed to follow. Ours is architectural — the part your security review will actually want to see. The database rules that govern ELEVANE's data (row-level security policies, enforced by Postgres itself) simply never grant any HR account, admin account, or company role a route to an individual's raw responses. There's no toggle to flip, no override for a difficult request, no back door for an urgent one — not even for your own admin account. If a company account tries to query below the group-of-5 threshold, the database returns nothing — not because a rule says not to, but because no path to that data was ever built. We'd rather a feature be structurally impossible than depend on nobody misusing it.