Trust and security
Updated 27 September 2026
What the Intelligent Wellbeing Engine stores, where it stores it, and what stops anyone seeing one person's answers. Each point says how it is enforced.
The five-person floor is a database constraint. Names never reach the database: IDs are turned into pseudonyms before storage.
Where it runs
- The database is hosted on a managed PostgreSQL service in London (UK).
- The website and its API run on a cloud hosting platform; the API runs in Dublin (Ireland).
- Each production licensee will have its own database, with its own secret salt for pseudonyms.
What it stores about people
- Pseudonyms only. You send an opaque user ID. Before anything is stored, the gateway turns it into
HMAC-SHA256(per-deployment secret salt, your ID). The salt sits in a secrets vault, never in the database.
- No names. The database has no name columns, and adding one breaks the licence. There is no free-text answer field.
- Answers stay separate. Individual answers, the answer ledger, the results and the audit log are separate stores. No employer or partner read path to individual answers exists.
Anonymity, enforced by the database
- A CHECK constraint on the results table rejects any value built on fewer than five people. Below that, only a coded reason is stored.
- Severe-distress counts need ten people, under their own constraint.
- Organisations do not nest, so there are no team or department breakdowns to slice down to one person.
- The gateway's own database role will not be able to read raw responses.
The full reasoning is in why the anonymity floor lives in the schema and the honesty rules.
Encryption and secrets
| What | How it is protected |
|---|
| Traffic | Every API call and every embedded check-in is served over HTTPS. |
|---|
| Your API secret | Shown once when issued, then stored only as a scrypt hash. If a secret leaks, the client is switched off and a new key is issued. |
|---|
| The pseudonym salt | Held in a secrets vault per deployment, never in the database. |
|---|
| Tokens in the browser | The browser only ever holds a ten-minute embed token for one person's check-in. Your API secret stays on your server. |
|---|
| Webhooks | Signed with HMAC-SHA256. Each signature carries a timestamp; reject anything older than 300 seconds. |
|---|
| Stored data | Being confirmed for the production project. |
|---|
Access, audit and limits
- The database is deny-by-default. The gateway is its only client.
- Authenticated calls are written to an audit log, which exists to show that no individual-level query ran.
- Sign-ups and token requests are rate limited, with counters held in the database. Sandbox keys also carry an answer quota.
- In production, the embed only loads inside the web addresses you register.
Paperwork
- Data processing agreement. You accept it online when you go live. Email us if you want to read it first.
- DPIA template. We give you a data protection impact assessment template for your deployment, on request. How we read UK GDPR for wellbeing check-ins.
- Privacy notice for this website and the sandbox: read it here.
Sub-processors
| Sub-processor | What it does | Where |
|---|
| Database hosting | A managed PostgreSQL service that stores the engine's database | London (UK) |
|---|
| Application hosting | The cloud platform that runs this website and the API | Dublin, Ireland (API) |
|---|
| Stripe | Billing and payments for licensees. It holds your billing details, never the people you measure. | Being confirmed |
|---|
| PostHog | Counts visits to this website, without cookies. It is not part of the engine. | European Union |
|---|
Certification, explained
Certification checks how your product shows results. It is not a security certificate. Every deployment passes it before production keys are issued, free tiers included.
- An automated conformance check runs against your real pages.
- It confirms withheld results show as withheld, with their reason and no value anywhere in the page.
- It confirms every figure shows its confidence interval, and small groups carry the provisional label.
- We then review three screenshots of your results view.
What the check looks for, in detail.