What's in the dashboard
Everything you need.
Nothing you shouldn't have.
Wellbeing signal
A directional read of self-reported mood across the org, scored 0–10. Overlay company events to read pressure against what was happening reorgs, benefit launches, big sprints.
Adoption & retention
Track from invitation through activation to sustained use. Retention cohort curves show whether Kaya stays useful not just whether people tried it.
Department breakdown
The same signals split by team, with a hard anonymity floor. Any group under the threshold is hidden entirely not blurred, not zeroed, hidden.
Campaigns
Surface a theme across the org a breathing challenge, Mental Health Week, a seasonal reset and see how many people take part, in aggregate.
SSO & SCIM
SAML and SCIM provisioning through Okta, Google, or your identity provider. Access is removed automatically when someone leaves.
Data residency
EU or US data residency for enterprise customers. Available alongside configurable anonymity floor and a dedicated success manager.
The question this answers
Can a corporate administrator using either the interface or direct manipulation of the corporate APIs retrieve or reasonably infer sensitive wellbeing information about a named individual?
No.
There is no endpoint that returns individual data. There is no organisation parameter to manipulate. There is no content table an administrator's credentials can read. There is no cohort below the floor that yields a number, and no filter combination that gets beneath it, because it is applied after every filter is combined.
Protections at the storage layer
What an employer
cannot find out.
Content is unreachable, by absence rather than by rule
Conversations, unsent letters, journal entries, glow notes and stored memories each carry a single policy binding the row to its owner. No organisational clause exists anywhere in them. An administrator's token matches no row of anyone else's writing not because a rule excludes them, but because no rule ever admitted them.
Administrators call functions, not tables
Administrators have no analytics table access at all. They call two definer-rights functions which return figures. There is no query available to them that returns a person.
The only input has never held a sentence
Organisational reporting derives solely from the signal log: one label from a fixed taxonomy, plus a date. Even inside a privileged function there is no message text present to leak.
Crisis signals never enter reporting at any cohort size
Themes reach reporting through an allowlist join, not a denylist filter. Distress the label meaning passive or active thoughts of self-harm is absent from that map and must stay absent. Its place is the person's own safety pathway and their nominated emergency contact.
Identity and analytics are separate roles
The roster belongs to people_admin; analytics resolution ignores that role entirely. Someone managing seats does not thereby gain wellbeing data, and someone reading wellbeing data cannot list who is counted in it.
The roster records no activity
Seats, department, licence state. No last-seen, no session count, no streak, no score. Activation is a boolean rather than a timestamp deliberately, because "activated at 14:07, just after the HR meeting" is a correlation an employer should never be able to draw.
Four anti-differencing mechanisms, layered -
because a floor alone is not enough.
Every mechanism reinforces the others. The result is a system where individual inference is not a practical option.
Whole calendar periods, chosen by the server
The caller picks how many periods back, never which dates, so there is no window to narrow until one contributor remains.
Cohorts snapshotted at period start
Moving someone between departments cannot alter a past number, so it cannot be subtracted from one.
Figures rounded to the nearest five
A one-person change usually does not move a bucket, and when it does the direction is ambiguous.
Every theme clears the floor independently
A theme with fewer contributors than the floor in a qualifying department is dropped, not shown.
On the anonymity floor
A floor of ten distinct contributors not ten members will suppress most cells for small and mid-sized customers. A two-hundred-person company with thirty weekly actives across eight departments will see very little. This is the correct privacy answer. The dashboard preview above shows suppressed cells honestly, because that is what the interface will look like for many organisations much of the time.
The rollout
Simple to deploy.
Hard to imagine going without.
Deploy in a day
SSO integration or invite link. No IT project, no six-month rollout.
People onboard naturally
Kaya meets each person where they are. No forms, no assessments just a conversation.
It builds understanding over time
The more someone uses Kaya, the more it can reflect back patterns they might not notice themselves.
You see the shape of it
Aggregate department themes rounded, floored, never individual show what your organisation is carrying.
let's talk
ready to put Kaya
to work for your team?
We'll walk you through how Kaya fits your organisation, answer questions about the privacy model, and get you set up properly — not just technically.