Privacy & security: k-anonymity built into the architecture
CoDash enforces privacy in code, not policy. Anonymous feedback has no author column, individual moods never reach managers, and every aggregate passes a k-anonymity gate before it is shown.
k-anonymity is a privacy guarantee in which any data point released about a group is indistinguishable among at least k individuals, so no one person can be re-identified. CoDash enforces k-anonymity in code for every manager-facing aggregate: a team mood, eNPS or survey figure is shown only when at least a minimum number of distinct people (k, defaulting to k≥5) contributed. Below the threshold, the chart does not exist - for anyone.
Privacy that is structural, not promised
Most HR tools protect sensitive data with a policy and a permission checkbox. CoDash protects it with data structures and code paths that make the wrong outcome impossible. Three guarantees sit at the core of the product and cannot be toggled off:
1. Anonymous means anonymous
The tables that store anonymous suggestions and feedback have no author column and no user foreign key. A submission simply is not linked to a person anywhere in the database. There is nothing to subpoena, nothing to leak, and nothing an administrator can “just quickly check”.
2. Managers see weather, not people
Individual mood check-ins are never serialised to manager accounts. Managers see weekly team aggregates only, and only when those aggregates pass the k-anonymity gate. Sickness reasons and other sensitive detail stay between the employee and HR.
3. The gate applies everywhere
Every new manager-facing aggregate in CoDash - mood, eNPS, survey results, even diversity monitoring across gender, ethnicity and disability - passes through the same k-anonymity gate. Low-response data is withheld rather than shown, because a chart drawn from three people is a chart that can identify three people.
Transparency that cuts both ways
- “Who has accessed my record” - every employee can see who viewed their profile.
- Full audit log - a complete trail runs underneath the product.
- Subject access exports - one-click SAR ZIP of a person's data.
- Anonymise-on-exit - leavers are anonymised while aggregates and the audit trail are preserved.
- Retention auto-purge - a scheduled job removes old leaver data per your configured retention period.
- Separation of duties - people cannot approve their own leave, self-grant TOIL, or bypass the privacy gate.
Access control and hosting
CoDash separates Admin, HR, manager and employee roles with real permission boundaries, supports OIDC single sign-on and TOTP two-factor authentication, tracks sessions with sign-out-everywhere, and hosts data in Europe. The AI manager coach only ever reads gated aggregates, and the product keeps working with no AI provider configured at all.
More questions answered → · See voice & surveys in the product → · Guide: anonymous feedback & k-anonymity →
See it for yourself
The demo is a full company you can wander around - book leave, send kudos, run a survey, try to break the privacy gate. Then tell us about your team.
Explore a live, safe sandbox