Candoorbeta

Anonymous voice interviews at scale

Anonymity you can verify, not take on faith.

A short spoken conversation becomes a theme, and never a person. Nothing is stored until the person has read exactly what would be stored and approved it. It remembers problems, not people.

Request a beta round How the anonymity works
Two fronts

One round, seen from two sides.

Candoor is the same round experienced two ways, and the guarantee only means something because both sides are true at once.

  • If you are asked to speak

    Ten minutes, and you decide what survives it.

    You talk about what went well, what went wrong, and what you would change. The words are then rewritten so names, teams and dates are generalised.

    You read that text, exactly as it would be stored, and approve it or not. Close the tab and there is no record the conversation happened at all.

  • If you are running the round

    Themes, ranked, with the reasons underneath.

    You open a round, state its rules up front, and invite the group. What comes back is what enough separate people raised independently, with enough texture to be real.

    There is no list of who said what, no per person view, and no drill down. Not restricted. Absent.

The mechanism

Most tools promise anonymity. We removed the ability to break it.

Anonymity as a policy is a setting somebody can change, a column somebody can join, and a support engineer who can look. This is a property of how the thing is built.

  1. Credentials, not identities

    You are admitted to a round with a credential that proves you are eligible to speak. It does not carry who you are. The system checks that you are allowed in without learning who came in.

  2. Nothing is stored until you approve it

    The conversation itself is not kept. What gets written down is the de-identified text you have read and approved, and nothing else. Walk away, or read the draft and decide against it, and there is no record the conversation happened.

  3. No participation record

    The system cannot tell you who took part. Which means it also cannot tell anyone else, under any amount of pressure. Reminders go to the whole eligible audience or not at all.

  4. Themes above a threshold

    Nothing reaches a report until enough separate contributors have raised it independently. One person's account never becomes one line in a document.

  5. An adversarial check before anything ships

    Every theme is tested against one question: could a colleague read this and work out who said it? If the answer is yes it does not go in the report, and what is held back is held back invisibly.

Said plainly

Two different promises, and only one of them is absolute.

The distinction most tools avoid

Speaker anonymity is architectural. The system does not hold the link between a person and their answer, so there is nothing to leak, subpoena or quietly look up.

Being talked about is a different question. A round about a team, a process or a decision will surface the team, the process and the decision. That is the point of running one.

We will not tell you that everyone named in a report is protected. We will tell you that nobody reached a report alone.

Where it fits

Built for the rooms where listening tools usually get blocked.

  • Works councils and employee representation

    If your works council has ever stopped a listening tool, bring them the architecture instead of the privacy policy. The answer to what could you do if you wanted to is nothing, structurally.

  • Regulated industries

    Where we promise not to look is not an acceptable control, and an auditor will ask what happens when somebody does.

  • Security conscious engineering teams

    Where the people you most need to hear from will assume the tool is compromised, and are technically capable of checking.

The limits

What we will not claim.

  • Very small groups cannot be made anonymous

    Not by any tool, including this one. If a round is scoped to six people, the words themselves identify the speaker. We will tell you that rather than let you promise your team something the maths does not support.

  • We do not infer emotion or wellbeing

    People report on how they are doing themselves, or not at all. Nothing is inferred about a person's state from how they sound.

  • A speech service hears the audio

    Your words are turned into text by a speech service and the audio is not kept. Work is underway to move that step onto the speaker's own device, so that no server ever hears a voice at all. Until it lands, we say so.

Find out what your people would tell you if it were safe to.

Candoor is in beta. We are taking a small number of design partners for the first rounds, and we would rather show you exactly what is built than sell you a roadmap.

Request a beta round Book a working session

Or reach us directly: contact@yolexlabs.com