LUCIDORG
Security · domain · PII
How we protect people and data
Design-intent spec for partners. Production controls match this page, if something here is not yet shipped, it is labeled as direction.
Two ways in
Agent onboard (preferred)
Connect HRIS or directory (SCIM / SAML / read-only API). We pull name, department, position, manager, enough to build the org map. No payroll, no SSNs, no performance files.
Or send a file
Upload a spreadsheet (CSV/XLSX) with the same fields. Template provided. Same validation, same n<5 checks, same deletion path after map confirm.
Unlocking lucidorg.com in your org
Email & domain allowlisting
- Allow outbound/inbound with
@lucidorg.com (and survey subdomain if used) so invites are not junked.
- Optional: SPF/DKIM/DMARC alignment when you send via LucidORG for anonymity.
- Optional: SSO (SAML/OIDC) so executives open results without a second password.
- Slack / Teams / SMS webhooks use your workspace tokens, LucidORG never posts without an admin install.
PII & survey trust
What we collect
- Roster: name, work email, department, position, optional manager ID, for mapping and invites only.
- Responses: Likert + optional free text. Stored against cohort keys (level, team), not against named individuals in results views.
- Suppression: any cell with n<5 is hidden in product and exports.
What we do not do
- No individual scorecards for managers.
- No survey rows feeding RIF, performance, or compensation systems.
- No sale of personal data. No training of public models on your responses.
Anonymity default
Invites sent from LucidORG (not the boss’s mailbox) are the recommended path. Client-domain send is available when culture already trusts the room, same backend privacy rules either way.
Engineering controls (intent)
- Encryption in transit (TLS 1.2+) and at rest (AES-256 / cloud KMS).
- Role-based access: exec / leader / manager / OE see altitude-appropriate views, same underlying assessment.
- Audit log of admin actions (roster upload, export, channel connect).
- Data residency options discussed at contract (region pin).
- Retention: roster and raw responses deletable on request; aggregated scores may remain under MSA.
- Penetration test / SOC2 roadmap shared under NDA, ask your LucidORG lead.
Merger / integration module
Single-org Mifflin work is the default product. Side-by-side, collision, and RIF navigator are an add-on when a second assessment is loaded, not part of the core briefing language.