Security

Accolgo runs on trust, and new starters are told so from the start. Nobody reads individual answers from new starters, line managers and buddies. Accolgo’s software turns them into a colour, the reasons behind it and a suggested next step for the manager, and the answers are stored encrypted at rest by our database provider. A note a starter chooses to write to their manager is read by the manager. The head of people sees it only if the starter’s next check-in is still not settling. When Accolgo picks up a safety concern in a note, it also goes to HR. A private word with someone senior is kept from the manager by the database itself, unless the manager is the only senior person available at that organisation. Beyond that, a starter’s note reaches the head of people only if the next check-in is still not settling, and when Accolgo picks up a safety concern in a note, it also goes to HR. The measures below are the appropriate technical and organisational measures Article 32 of the UK GDPR requires, including those exceptions.

Access

• Every organisation’s data is isolated: row-level security on every table, zero anonymous table access, and org scoping enforced again in the application layer.
• Check-in links are private, single-use, randomly generated tokens that expire after 14 days. A guessed URL opens nothing.
• Managers see their own team; the owner and head of people see their organisation.
• Accolgo’s own platform operators can see that a check-in and a note exist, not their content, on an internal page open only to Accolgo’s own staff.

Platform

• Encryption in transit everywhere; encryption at rest at the database provider.
• Secrets live in environment configuration, never in code or the repository.
• Migrations are numbered, reviewed and applied with explicit grants; every change to grants is checked against prior revocations.
• Error monitoring with per-organisation tagging; an append-only email delivery log.

Reporting a concern

If you believe you have found a vulnerability, email dermot@clickonic.co. We acknowledge reports promptly, do not pursue good-faith researchers, and ask that you avoid accessing other people’s data while demonstrating an issue.