Who can see what

Access is enforced inside the database itself, on every table — not just by hiding buttons on screen. A person can only ever read what their role allows.

Between companies

Each company sees only its own programmes, people and figures. There is no path from one company’s data to another’s.

Within a company

• Interns see their own tasks, submissions, feedback and KPIs — never another intern’s, and never any cost or return figure.
• Supervisors see only the interns assigned to them and their work — never the programme’s costs or returns.
• Admins see everything in their own company, including costs, returns and every submission.

Files

Uploaded files have no public address. They open through private links that expire after a few minutes, and only for the intern who uploaded them, their supervisor, and the company’s admins.

Shared reports

A report shared by link can be read without an account. It contains programme-level figures only — no intern is named, and no submission, feedback or rating is included. Links expire after 7, 30 or 90 days, can be withdrawn at any time, and record how often they are opened. See Share a report by link.

Records that cannot be changed

Submissions, reviews, ratings, KPI measurements and saved ROI baselines are append-only: once written, they cannot be edited or deleted — by you, by us, or by anyone. This is what makes a report of record trustworthy. The Privacy notice explains how this works alongside a request to erase personal data.

Accounts

• Passwords are never stored in readable form, and passwords known from data breaches are refused.
• Repeated failed sign-ins are paused for a few minutes.
• Invitation links work once, expire after 14 days, and only for the address they were sent to.