Privacy & security: k-anonymity built into the architecture

Privacy that is structural, not promised

Most HR tools protect sensitive data with a policy and a permission checkbox. CoDash protects it with data structures and code paths that make the wrong outcome impossible. Three guarantees sit at the core of the product and cannot be toggled off:

1. Anonymous means anonymous

The tables that store anonymous suggestions and feedback have no author column and no user foreign key. A submission simply is not linked to a person anywhere in the database. There is nothing to subpoena, nothing to leak, and nothing an administrator can “just quickly check”.

2. Managers see weather, not people

Individual mood check-ins are never serialised to manager accounts. Managers see weekly team aggregates only, and only when those aggregates pass the k-anonymity gate. Sickness reasons and other sensitive detail stay between the employee and HR.

3. The gate applies everywhere

Every new manager-facing aggregate in CoDash - mood, eNPS, survey results, even diversity monitoring across gender, ethnicity and disability - passes through the same k-anonymity gate. Low-response data is withheld rather than shown, because a chart drawn from three people is a chart that can identify three people.

Transparency that cuts both ways

• “Who has accessed my record” - every employee can see who viewed their profile.
• Full audit log - a complete trail runs underneath the product.
• Subject access exports - one-click SAR ZIP of a person's data.
• Anonymise-on-exit - leavers are anonymised while aggregates and the audit trail are preserved.
• Retention auto-purge - a scheduled job removes old leaver data per your configured retention period.
• Separation of duties - people cannot approve their own leave, self-grant TOIL, or bypass the privacy gate.

Access control and hosting

CoDash separates Admin, HR, manager and employee roles with real permission boundaries, supports OIDC single sign-on and TOTP two-factor authentication, tracks sessions with sign-out-everywhere, and hosts data in Europe. The AI manager coach only ever reads gated aggregates, and the product keeps working with no AI provider configured at all.

More questions answered → · See voice & surveys in the product → · Guide: anonymous feedback & k-anonymity →

Frequently asked questions

What is k-anonymity and how does CoDash use it?

k-anonymity is a privacy model in which any released record is indistinguishable from at least k-1 other individuals, so no single person can be singled out. CoDash applies it to every manager-facing aggregate: a team-level mood, eNPS or survey result is only shown when at least a minimum number of distinct people (the k threshold, k is at least 5 by default) have contributed. Below that threshold nothing is displayed, to anyone.

Can a manager or admin ever see an individual mood check-in?

No. Individual mood check-ins are never serialised to manager accounts - only weekly team aggregates that pass the k-anonymity gate. This is enforced in the application code, not left to a policy, and the demo lets you probe it directly.

How are anonymous suggestions stored?

Anonymous suggestion and feedback tables have no author or user column by design. There is structurally no link between a submission and a person, so the data cannot be de-anonymised, subpoenaed back to an individual, or quietly checked by an administrator.

What GDPR tooling is built into CoDash?

CoDash includes one-click subject access request (SAR) exports as a ZIP, anonymise-on-exit for leavers, configurable per-record-type retention with a scheduled auto-purge of old leaver data, a full audit log, and a 'who has accessed my record' panel for every employee. Data is hosted in Europe.

Where is CoDash data hosted?

CoDash data is hosted in Europe. Access is controlled by separated Admin, HR, manager and employee roles, with OIDC single sign-on and TOTP two-factor authentication available.