Minimum group size
Reports are aggregate by default. No result is shown for a group below the minimum size, and you can set your own minimum. The floor holds across every filter and drill-down, so nobody can back out a small group by combining or subtracting cuts.
| Default | 5 |
Pseudonymization
Names, emails and employee IDs become codes in memory at ingestion, and only hashed values reach storage. You hold the lookup table and hashing key, so re-identification happens only on your side. We treat pseudonymized data as personal data under GDPR. Customer-side hashing keeps direct identifiers inside your environment.
| Default | Hashed in our pipeline at ingestion |
| What you can change | You can hash inside your own environment before anything leaves, so no direct identifier ever reaches us |
Data states
Where each state lives and who can see it.
| Data state | Where it lives | Who can see it |
|---|---|---|
| Named | Your HR and recruiting systems | You only |
| Pseudonymized | MatterMore's single-tenant warehouse | Named MatterMore engineers and named people analytics users on your side |
| Aggregated (groups of five or more) | Your warehouse and reports | Managers and HR partners, by role |
| Re-identified | Inside your environment only | People you authorize, at your request |
Excluded employees (opt-out)
You can exclude any employee from analysis.
| Default | No one is excluded |
| What you can change | You can leave an employee out of the HR file you share, or name them to us |
Individual-level views
We enable individual-level views only at your request, for decisions you own, such as retention planning. Those views are re-identified inside your environment by people you authorize.
| Default | Off |
| What you can change | On at your written request, re-identified inside your environment |
Data sources
We collect only the data the work needs, from the fields on a data inventory you approve. Collaboration sources, if you add them, are metadata only.
| Default | The approved inventory only |
| What you can change | Collaboration and badge metadata stay off until your DPIA and consultation are done |
Data retention
We keep your data for the engagement and delete it within 30 days after it ends. Backups roll off on their normal schedule.
| Default | Kept for the engagement and deleted within 30 days after it ends |
| What you can change | You can set a shorter period |
Employee notice
We supply a plain-language employee notice for you to share before any data flows. It covers what we collect, why, who sees it and how long we keep it.
| Default | We supply the notice |
| What you can change | You share it with employees before any data flows |
Audit logs
Ingestion, pseudonymization and warehouse access are logged.
| Default | Logged |
| What you can change | Logs are available on request |
Role-based access
| Role | Sees |
|---|---|
| Managers | Aggregates for their own organization |
| HR business partners | Their client groups |
| Named people analytics users | Pseudonymized row-level data |
Access is role-based. Row-level security is enforced where the data lives and mapped to your org hierarchy. Ingestion, pseudonymization and warehouse access are logged, and logs are available on request.
What we never collect or do
- No special-category data. That means health, ethnicity, religion, union membership and similar.
- No message, email or document content
- No sharing of your warehouse. Your data sits in a dedicated single-tenant warehouse and is never co-mingled with other customers' data.