Data privacy & anonymity

No one at your company can see your individual answers

This isn't a policy we ask admins to follow, it's not something the app's interface just happens to hide. There is no path in the system, not a hidden menu, not an export, not an API call, that returns one specific employee's answers or score to a company admin or manager. Every dashboard and report an admin can see is built from database functions that only ever return already-averaged numbers across a group of people, never a single row tied to one person.

Small groups get suppressed automatically

Averaging alone isn't enough if a group is small enough that the average reveals who it belongs to. So any breakdown by a single category, age range, gender, tenure, location, or department, is withheld entirely unless at least 5 people are in it. Cross-tab breakdowns (for example, a specific department's scores broken out by tenure) need at least 10 people, since combining two categories narrows the group further. If a slice is too small, the dashboard simply doesn't show it rather than showing a misleading or identifying number.

Your work email confirms you belong, nothing more

Signing in (including with Google) verifies that you're a real employee at a company registered on EXD Score, so your results can be shown back to you over time. It doesn't create any link an admin can query between your identity and your answers, that link simply isn't exposed anywhere in the system, by design.

What your company's admin actually sees

An admin's dashboard shows:

• Company-wide and round-over-round average scores, overall and by dimension.
• Demographic and departmental breakdowns, only for groups large enough to suppress identification (see above).
• How many people have submitted so far in an active round, as a plain count, not a list of who has or hasn't.
• An AI-generated narrative report built entirely from these aggregated numbers.

An admin never sees a list of individual scores, individual answers, or which specific person gave which answer, under any circumstance.

If your company works with an outside consultant

Companies can optionally share their aggregated round reports with an external consultant through an expiring, tokenized link, generated and revocable by the company's own admin. What's shared is the same aggregated report an admin can already see, never raw individual answers, and the link stops working once it expires or is revoked.

How the data itself is protected

• All data is stored in Supabase-managed Postgres with row-level security enabled on every table, there is no client-facing way to read another employee's row.
• Reports shared with consultants are served through Supabase's private storage with short-lived signed links, never a public URL.
• Rate limiting protects login, signup, and password-reset from brute-force and spam attempts.
• Our own internal Super Admin accounts, which manage company setup and billing, require both a password and a time-based authenticator code (TOTP two-factor authentication) to sign in.
• If a company account is ever deleted, all its data, employees, submissions, and reports, is deleted with it. Nothing is left behind in a partial or orphaned state.

Questions

This page explains the anonymity and security architecture in plain language. For the formal legal terms, see our Privacy Policy. If you have a specific question your company's admin or our team can be reached through the contact form.