SafePorter separates the system that knows who was invited from the system that receives what people say.
Your organization holds names and email addresses on infrastructure it controls and sends the invitation. The respondent answers using a code. SafePorter receives the response without the person's name or email address. Your organization receives aggregate results rather than individual responses. The identity and the answer are deliberately kept apart.
Software runs on your own infrastructure, inside your network, holding the names and email addresses in a local database. It generates a code for each person and sends the invitation through your own mail server.
SafePorter has no access to the names, the addresses, or the mail server.They open a separate portal, entering your organization's key and their code rather than a name or an email address. They answer what they choose to answer.
No account, no password, no profile.Responses are stored under a value derived from that code using a secret held separately from the data. Raw answers are kept in the respondent's own region.
The organization has no access to individual responses at any point.Results are assembled and published to your dashboard as aggregated percentages, with groups too small to report safely withheld before anything reaches you.
Dashboards show a published snapshot rather than a live feed, so a person joining or leaving never opens a visible gap.Both look like constraints. Both are the reason the promise holds.
Most vendors would rather host everything: it is simpler to sell and simpler to run. Holding your people's names and addresses on our servers would also make the central claim of this page impossible.
So the component that holds identity runs where you already run things, under your access controls, with no inbound ports open to us.
A live dashboard leaks. If results updated the instant someone answered, deleted their data or left, the change itself would point at a person.
Publishing a snapshot instead means the trend survives while the individual stays invisible.
| Your organization | SafePorter | |
|---|---|---|
| Names and email addresses | Yes, on your own systems | No access, at any point |
| Individual responses | No access | Held under a code, never with a name |
| Aggregated percentages | Yes, in your dashboard | Yes |
| Results for very small groups | Withheld | Withheld before publication |