Who sees what – and who does not: confidentiality at LEADBeyond 360°

A 360° only works if raters can answer honestly and the leader can be sure their report will not be passed around unnoticed. Both assurances can be made in a process document – or enforced in the software. LEADBeyond 360° does the latter; confidentiality here is a property of the system, not a promise: the anonymity rules apply during aggregation on the server, not merely in the display, and access rights are enforced server-side per role. This page describes the rules as a data-protection officer or CHRO would audit them; it is not legal advice. What "anonymous" can and cannot mean in any 360° is covered in Is 360° feedback anonymous?.

When a rater group is shown separately – and when it is not

Each rater group – supervisors, peers, direct reports – is reported separately only once the number of completed raters in that group reaches the anonymity threshold. The default is two; the consulting team configures it per cycle, and HR does not see it as a setting. Below it, a group's answers are folded into the pooled "all others" view and appear nowhere on their own.

A second rule closes the gap thresholds alone leave open: if a group value could be derived by subtracting the other groups from the total, the pooled value is withheld too (the residual rule). No single answer remains recoverable – not even with a calculator.

A report is generated only once the self-assessment is complete, at least two rater groups meet the threshold, and the deadline has passed or every invited rater has completed; only the consulting team can make an exception, and every exception is logged. What this means for nominations: How many raters does a 360° need?.

Free text: never attributed, never processed by AI

Raters can comment on every item and answer three open questions at the end (stop, start, continue). The same rules apply to all free text:

• No comment is ever linked to a name – in any view, for any role.
• Comments appear in randomised order; they carry a group label such as "peers" only if that group meets the threshold.
• If only one rater completed the assessment in total, all free text is hidden.
• In the current version free text is not analysed, clustered or summarised by AI; it is shown verbatim and threshold-protected. There is no automated decision-making within the meaning of Art. 22 GDPR.

Supervisors: visible separately only by explicit opt-in

In many programmes the supervisor group is one person. By default it follows the same threshold as every other group – a single supervisor is not shown separately but counted within "all others". Where the supervisor's view should deliberately be visible, the consulting team can enable this explicitly per cycle; it is off by default. Even then the residual rule collapses the column if the remaining rater base is too thin. Agree this in programme design, before invitations go out, and make it transparent to the supervisor – never apply it afterwards.

Who sees what: the access matrix

HR has exactly one exception: an organisation-wide aggregate – distributions per dimension, pillar values, training priorities, the spread of defense patterns, the share with a Well-being risk – without names, individual scores or free text. It appears only when three conditions hold at once: the cycle is closed, at least five leaders have a report, and the consulting team has explicitly enabled the view for that cycle. The reasoning behind this model: Can HR see individual 360° results?.

Equally important is what HR cannot do: methodology – anonymity threshold, scoring, release mode – stays with the consulting team. HR creates cycles, adds leaders, proposes process settings, sends reminders and tracks progress: full process oversight, no access to results.

Why no report goes out unreviewed, and none can be changed afterwards

No report reaches a leader unreviewed. Once generated, it goes to the consulting team, who can add a report-level note and per-dimension annotations, put it on hold, or release it – by explicit click or automatically on a pre-agreed go-live date unless on hold. Only the release triggers the notification to the leader.

A released report is immutable: it stays pinned to its released version. A late response or a correction creates a new version, which the leader sees only after another explicit, logged release. There is no quiet "un-release"; an emergency withdrawal is an administrative exception, audit-logged and communicated to the leader personally. The PDF export carries "Confidential – LEADBeyond 360° Leadership Assessment" in its footer.

Where the data lives and who processes it on our behalf

Database, authentication, file storage (including the PDF reports) and the application itself run in Frankfurt am Main. The privacy policy names the processors working for LEADBeyond under Art. 28 GDPR processing agreements; the regions reflect our configuration:

• Supabase – database, authentication and file storage, EU region Frankfurt.
• Vercel – hosting and delivery of the application, server region Frankfurt am Main.
• Resend – transactional email such as invitations and reminders, configured for its EU sending region.
• Sentry – error and stability monitoring, where enabled.

We phrase the EU question exactly as the privacy policy does: the platform is designed for data storage within the EU; where an individual provider processes data outside the EU/EEA, this rests on appropriate safeguards, in particular EU standard contractual clauses. One concrete example: Resend itself documents that account data, email metadata and logs are stored in the United States whatever sending region is selected. Anyone promising that data "never leaves the EU" is promising more than such a provider chain can deliver.

• Encryption in transit (HTTPS) and at rest (AES-256, managed by Supabase); PDFs in private storage; daily automated backups.
• Supabase and Vercel publish their own SOC 2 Type 2 reports and ISO 27001 certifications – attestations of the vendors, not of LEADBeyond GmbH.
• Sign-in: leaders and raters receive a single-use magic link (valid 24 hours), then set a password for all later logins. Two-factor authentication is mandatory for LEADBeyond administrators.
• Only technically necessary cookies – no tracking, analytics or advertising cookies, and no analytics service sending data outside the EU.

What rights data subjects have, and where the legal basis is decided

The platform processes account and contact data (name, email address, language, hashed password), assessment data (ratings 1–6, optional free text, role and assignment) and usage and log data. The rights to access, rectification, erasure, restriction, data portability and objection (Art. 15–18, 20 and 21 GDPR), and the withdrawal of consent, can be exercised by an informal email to talents@LEADBeyond.de; access requests are answered with a structured export, erasure cascades across the linked records, with log entries pseudonymised rather than deleted. The competent supervisory authority is the Bavarian State Office for Data Protection Supervision (BayLDA).

The legal basis depends on how your organisation sets the programme up – processing on behalf of the client, legitimate interest or, where obtained, consent – and is agreed contractually with you, together with the controller/processor roles, before your programme starts; the privacy policy records that roles, legal bases and processing agreements are being finalised as part of the legal review. Retention periods are governed by the privacy policy.