Trust Center

• k-anonymity floor: a manager never sees a team aggregate computed from fewer than the configured minimum of consenting members.
• Consent as the join key: only data from employees who opted in is ever included in any aggregate.
• Differencing protection: aggregates are withheld when comparing two cohorts could re-identify an individual.
• No individual burnout score, check-in, or activity ever reaches a manager or admin — only privacy-protected aggregates.
• Single sign-on (OIDC/SAML) and SCIM provisioning run on our own infrastructure — no third-party identity broker.

• Self-service data export: any employee can download a complete JSON copy of their own data at any time.
• Right to erasure: any employee can permanently delete their account and data themselves.
• Configurable retention: each organization sets how long reports and health snapshots are kept (1–60 months).
• Legal hold: organizations can suspend deletion for litigation or audit.

Primary application and database hosting is in the EU (Hetzner, Finland/Germany).