Written for your IT function to read.

1 Purpose and scope

This policy states how Compass Performance protects information held in the Compass platform and in the working artifacts produced during an engagement. It applies to every Compass system a client adopts, to every Compass administrator, and to any subcontractor Compass engages.

It is written so a client IT function can review it directly. Where a control is not yet formalised, it is labelled as such in Section 12 rather than described as if it were in place.

2 Roles and responsibilities

Compass Performance is accountable for the platform, its administrators and its subcontractors. The client organisation is accountable for the accuracy of the records it supplies, for who it nominates to hold access, and for the employment, selection and personnel decisions it makes using Compass outputs.

• Compass Administrator — grants and revokes access, governs report generation and release, keeps the audit record.
• Client system owner — the single named client-side owner of each adopted system, and the recipient of access-change notices.
• Poster / Member / Other — scoped platform roles; a role never carries more access than its stage of the work requires.

3 Access control

Access is by named account. Shared credentials are not issued to clients, and no role is inferred from anything held in the browser — role is resolved on the server for every request, on every export and on every print path.

Administrator sign-in requires an authenticator code in addition to the password. Access is reviewed at each engagement stage gate, and revoked on the same working day a person leaves the engagement.

• Four access levels only: Administrator, Poster, Member, Other.
• Least privilege: a level sees only the records its stage of the work requires.
• Reporting is not self-service — a Compass Administrator governs generation, filtering, approval and release.
• Refused access attempts on report surfaces are recorded.

4 Data handling

Client data is held in the platform database and in the engagement's document record. Compass does not sell, rent, trade or license client data, does not use it to train any model, and does not use one client's data to inform another client's work.

4.1 Classification

Every artifact carries its classification on the page: Public, Client Confidential or Compass Internal. Analysis in progress is additionally marked Draft. Reports released to a client carry the release watermark and the releasing administrator's name.

4.2 Encryption

Data is transmitted over TLS between the browser, the platform and its service providers, and is stored encrypted at rest by the hosting and database platform.

4.3 Record of truth and document handling

The engagement's document record of truth is the client's dedicated folder structure in Compass's Dropbox tenant, which issues every shareable link. Messaging tools announce a link; they are never the delivery mechanism and are never the record.

Links to client-confidential artifacts are issued to named recipients. Public or unrestricted links are not used for client-confidential material.

4.4 Retention and deletion

Retention is client-directed. Absent a written instruction, Compass holds engagement records for 24 months from the close of the engagement stage that produced them, then redacts identifying detail or deletes the record.

On the client's written instruction, Compass returns or deletes the records identified in that instruction within 30 days, and confirms completion in writing. Records Compass must keep to meet a legal obligation are identified in that confirmation, with the obligation named.

4.5 Recording, transcription and AI tool use

Sessions are recorded or transcribed only when the host has told participants in advance and the notice appears on the invitation. A participant may ask that recording stop, that a passage be excluded, or that they be excluded from the transcript, and the host must honour the request.

Compass uses AI tools to draft, summarise, structure and translate: to turn a transcript into minutes, to draft a role specification or attraction statement, to structure an assessment summary. AI drafts are a hypothesis until a named human verifies them.

AI tools are never used to make or automate a decision about a person. Selection, rating, disposition, promotion, discipline and separation decisions are made by named humans on the client side, on the record.

• Notice first: recording and transcription require advance disclosure on the invitation.
• Draft, never decide: every AI-derived artifact is reviewed and approved by a named person before it is used or filed.
• No training on client data: content sent to an AI provider is not used by Compass to train models, and Compass uses providers under terms that do not train on its submitted content.
• Minimum content: only the material needed for the task is submitted — special-category data and identifiers are removed where the task does not require them.
• Recorded provenance: an artifact produced with AI assistance records which tool assisted, who verified it and when.
• Human override: any participant or client owner may require that a summary be corrected, withdrawn or deleted.

5 Subcontractors and service providers

Compass engages the service providers listed in the Personal Data Notice, each under its own written data processing terms. A new provider that will hold client-confidential material is notified to the client system owner before it is used, and the client may object.

6 Logging and monitoring

The platform records administrator sign-in, access grants and revocations, report generation and release, export and print actions, and refused access attempts on governed surfaces. Compass produces the relevant extract to a client system owner on request for that client's own records.

7 Change control

Platform changes are made through version-controlled deployment with automated checks that run before release, including access-gate checks that fail the build if a governed surface becomes publicly reachable.

8 Incident response

On becoming aware of a confirmed or suspected compromise of client data, Compass contains the issue, records what happened, and notifies the client system owner without undue delay and no later than 72 hours after confirming that client data is affected. The notice states what is known, what is not yet known, and what Compass is doing next.

Compass supports the client's own notification obligations with the facts in its possession. Compass does not notify the client's employees, candidates or regulators on the client's behalf unless the client instructs it in writing.

9 Business continuity

The platform database is backed up by the hosting provider. Engagement artifacts are held in the document record of truth, which is independently versioned, so the loss of any single working surface does not lose the engagement record.

10 Personnel

Every person with administrator access is bound by written confidentiality obligations, holds a named account with two-step verification, and is granted access only to the engagements they work on.

11 Client obligations

The client keeps its nominated owner list current, tells Compass on the day a person's access should end, gives participants the notices its own law requires, and does not upload data to a Compass system that the engagement does not require — in particular medical, biometric, financial-account or government-identifier data, unless the parties have agreed in writing how it will be handled.

12 Control register and status

The register below states each control and whether it is in place today or being formalised. Compass does not claim a certification, an external audit outcome or regulatory compliance in this policy. Where a client requires certified assurance, that is stated in the engagement agreement and met through the client's own instruments.

Control register

Security contact

Security questions, IT review requests and incident reports: skopecky@compassperformanceinc.com, 224.307.0912. Compass answers a client IT review questionnaire directly and will state where an answer is "not yet formalised" rather than overstate a control.