Anonymity the database enforces.

For the analysis and every report, yes, and by construction rather than by policy: capture is written against a derived code and never an identity, and no table maps one to the other. In the conversation itself, two people see and hear each other.

Accounts and memberships on one side of the store; transcripts, written Perspectives, survey answers and ratings on the other, redacted of personal identifiers before they are stored. The two sides share no key finer than the date.

Every surface that captures what a person says states how it is treated, and the statement is never suppressed. Each consent is recorded naming the document and its version, so what was in force at the time is recoverable.

Only the de-identified corpus of one generation, assembled after the cohorts a reader may never see have been suppressed. Nothing sent to or returned by the model survives beyond the report itself.

A person is erased in full — account, memberships, consent records and any identified material — after which their code can never be derived again. Anonymous capture is untouched: it names no one, and no mechanism exists that could find one person's records.

Sign-in is delegated to an identity authority — Google, Microsoft or company SSO, a magic link or a one-time code — so the product holds no password, and two-factor can be required. Inside, every operation tests the privilege it requires and every administrative act is audited.

No. Everyone uses a browser, nothing runs on a device or inside your network, and no integration into your own systems is required or offered.

Where an Event permits one, a recording is an identified artefact served at its own address under its own privilege. It never enters the analysis, is never read by generation, and appears in no report.