Security and Privacy

Where data sits

Primary storage is Cloudflare’s Western Europe region, with the website served by Vercel. All processing is subject to UK GDPR and the Data Protection Act 2018. We describe the region as Western Europe, not as UK-only, because that is where it is.

The survey and portal pages carry no analytics of any kind: no Google Analytics, no session recording, no visitor measurement. This is enforced in the code, not by configuration.

Who can see individual responses

Nobody, including us, can tie a survey answer to a person. Your employer can never see who said what. Employers receive counts and patterns only, never an individual response.

What is never stored against a survey response:

No name, no email address, no employee number, no login and no IP address.
No symptom severity, no diagnosis, no medication and no clinical information. The survey asks what is affecting work, not how badly someone is affected.
No date of birth, age or sex. The survey is sent to everyone, never to a group selected by age or sex.
No per-person invitation links and no non-responder list, so nobody can work out who has or has not answered.

The reporting floor

Nothing is reported for any group of fewer than 10 people. Below the floor no number is returned at all, only whether any answers have arrived, so a count cannot be watched up to ten.
Health-related tallies above the floor are rounded to the nearest 5.
Work areas break out separately only once 10 or more people in that area have answered. Smaller areas are folded into the whole.
Free-text answers are shown without the work area attached, so a comment can never be pinned to a small team.
Service ratings from optional employee accounts are shown as rounded totals and never below 10 raters.
These rules are enforced in the system that produces the numbers, not by policy. There is no report an employer can run that breaks them and no setting that turns them off.

What employees see

Seven questions on one screen, taking under two minutes. Every question is optional except the last. The wording is framed around work, never health.
No login, no account and no app. The survey link opens in any browser.
Where a free-text answer is possible, the survey says beside the box that the employer reads that text word for word, and to leave out details that identify them.
The only client-side storage is a 24-hour browser cookie noting that this browser has already answered, as a courtesy against double submission. It identifies nobody.
An employee may choose to create an optional space with us, using a personal email address; work addresses are refused. That account is between them and us. Their employer is never told who has an account, or whether any person took part.

What the employer receives

Total responses and, once you record how many people were invited, the response rate.
Counts for each answer option, ranked, once 10 responses are in.
Which of the support you already fund people have used, and how many did not know about any of it.
Whether requested adjustments happened, and why people who wanted a change never asked.
An average supported-at-work score, and the change in it between rounds.
Free-text answers, word for word, without the work area attached.
A written evidence paragraph and the documents composed from those figures. Nothing in any of them is generated by a language model; every figure is computed from the aggregates above.

Who processes data

For employer and portal data, and for optional employee accounts, Summ Base (Consult Blue Ltd) is the controller. For survey answers, the employer is the controller and Summ Base is the processor, acting only on the employer’s instructions.

The services that process data for us, as the privacy policy names them: Cloudflare (database and application hosting), Vercel (website hosting), Stripe (payments, buyers only; card details go to Stripe directly and never touch our systems), Resend (transactional email to employers, and to employees only when they created an account and asked for something), and Anthropic (the support assistant on the marketing pages only; survey answers, ratings and account data are never sent to it).

We take no commission from any provider we measure or signpost, and no survey data is ever sold or shared for marketing.

Retention

Survey data is kept while the employer uses the service and deleted within 90 days of that use ending, or sooner if the employer asks. Employees can ask us to delete their account and everything linked to it at any time, and the employer is never told they asked. Enquiries are kept only as long as needed to reply and follow up, and deleted on request.

Access to the portal

The portal link is the key. There is no password to set, store, leak or guess. Keep the email that carries the link, and treat the link as you would a key.
Lost it? A fresh link is sent to the work email the account was set up with, and to nowhere else: get your link re-sent.
Summ Base keeps a time-stamped audit trail of configuration changes to your survey that never contains free text or logins.

What we can provide to procurement

This page.
The privacy policy, which sets out controller and processor roles, lawful bases, processors, retention and rights.
The terms of service, including the licence, price, renewal, refund and data terms.
The data protection note, generated in your portal from your own survey setup, for your privacy lead. It describes the design so that your privacy lead can decide what assessment, if any, it needs. It is not a data protection impact assessment and it is not legal advice.

How to reach a person

hello@summbase.co.uk, answered by a person within one working day. Employees exercise their UK GDPR rights with us directly, not through their employer, and the employer is never told a request was made.