The protections are structural, not procedural
EECly holds harassment complaints, whistleblower reports and mental-health engagement. Those are the most sensitive records an employer will ever touch, so the boundaries are enforced in software at the point every read happens — not by policy, training or good intentions.
Who can see what
The single question every employee asks before trusting a workplace app, answered as a table rather than a paragraph.
| Data | Who can open it | Can HR see it? | Employer aggregate |
|---|---|---|---|
| Sexual-harassment complaint | Internal Committee only | No | Never — no group figure is releasable |
| Whistleblower report | Audit Committee and Vigil Officer only | No | Never — no group figure is releasable |
| Data-protection grievance | Data Protection Officer only | No | Never — no group figure is releasable |
| Counselling engagement | The assistance provider only | Aggregate only | Higher group floor, with statistical noise |
| Wellbeing and health signals | The employee only | Aggregate only | Higher group floor, with statistical noise |
| Training completion | HR and Compliance | Yes — it is the statutory evidence | Individual status is the record |
The one narrow exception. Where there is a credible risk of imminent harm, a designated responder may escalate. That path is restricted to named safety roles, limited to the minimum information necessary, and permanently logged. It exists to keep people alive, and it is the only route by which counselling information can move.
How it is enforced
Access is enforced at the database, not in application code
Row-level security decides what a request can read inside the database itself. A request that should not see something cannot see it even if the application layer is wrong. Access decisions fail closed — an unrecognised role is granted nothing rather than everything.
Confidential cases live in a separate store, and every read is logged
Harassment, whistleblower and grievance material is held apart from the rest of the platform. Every access to a case is recorded, so the question "who opened this file" always has an answer.
Group figures cannot be reverse-engineered into individuals
An aggregate is released only above a per-data-type group-size floor. Sensitive categories carry a higher floor and added statistical noise, the number of such queries in a period is capped so narrow questions cannot be combined, and a team permanently too small is never reported on at all.
Deletion means different things, and we say which
Wellbeing and counselling data is destroyed irreversibly by destroying its encryption keys. Survey responses are permanently detached from identity. Statutory records are retained, because the employer is legally obliged to hold them — and a legal hold pauses deletion while a case is open.
Where data lives
Production systems run in India, in the AWS Mumbai region (ap-south-1). This is enforced rather than merely intended: an automated check fails the build if a non-Indian region is ever configured. Data is encrypted in transit and at rest.
Sub-processors
The complete list of third parties involved in running EECly. We do not sell personal data, do not use it for advertising, and do not use employee data to train artificial-intelligence models.
| Provider | Purpose | Data location |
|---|---|---|
| Amazon Web Services | Hosting and storage | India (ap-south-1) |
| Email delivery | Notifications and case correspondence | Transit only |
| Notifications, where the employer enables it | Transit only | |
| Okta | Single sign-on, where the employer uses it | Identity assertion only |
| Razorpay | Employer subscription billing | No employee data |
What the app asks of a device
The EECly Android app requests exactly one device permission: internet access. It does not request the camera, microphone, location, contacts or files.
Security review and documentation
Our certification reports are available to prospective customers under a non-disclosure agreement. For a security review, a data processing agreement, or a completed diligence questionnaire, write to legal@annotatory.com.