Employee privacy

PromptGlass is built to govern AI use without turning into a surveillance tool. Analysts see pseudonymous identities by default. Revealing who someone is requires a documented reason and a second approver. Team reports hide small groups. Every access to prompt content is itself audited. These controls are on by default, and the strictest ones can be enforced by region.

Pseudonymization by default

Every person gets a stable pseudonymous ID (u_7f3a…). Analytics, dashboards, exports and the MCP server show pseudonyms plus organizational attributes such as department and location. The mapping from pseudonym to identity is stored separately and encrypted at the application layer.

Four-eyes re-identification

To reveal an identity, for example during a security investigation of a credential leak:

1. An investigator with the privacy.reidentify.request role opens a request, references a case or event, and states a reason.
2. A second person with privacy.reidentify.approve (often from HR, Legal or the DPO’s office) approves or rejects it.
3. On approval, the identity is visible to that investigator, for that case, for a limited time (default 72 hours).
4. The request, approval and every view are written to the immutable admin audit log.

High-severity rules can be set to auto-reveal to security (for example, secret.* leaks). This must be turned on explicitly, and it is visible to everyone on the transparency page.

Role-based content access

Role	Can see
viewer	Aggregates only (k-anonymous)
analytics.individual	Pseudonymous individual metrics
investigator	Event details and stored (redacted) content for assigned cases
investigator.full	Unredacted stored content (requires storage mode full)
admin	Configuration; no content access unless granted an investigator role

Works-council and GDPR mode

For regions with co-determination requirements (for example, Germany under BetrVG §87(1)6, plus similar rules in France, the Netherlands and Austria), turn on works-council mode per group or region:

• Storage is limited to metadata-only, except for the data classes you list (for example, credentials)
• Individual-level analytics and productivity scores are turned off. Only team aggregates above the k-threshold remain.
• Coaching messages are on. Blocking is limited to the data classes you list.
• Policy changes affecting the group require an additional approver role, which can be held by a works-council representative.

PromptGlass provides the technical controls. Your works agreement (Betriebsvereinbarung) or equivalent sets out which controls you use.

Transparency for employees

• Transparency page: a read-only page at https://<tenant>/transparency lists the sensors deployed, what is captured, retention and which rules can reveal identity. Link to it from your acceptable-use policy.
• Extension popup: shows the user what is monitored on the current site, and their own recent coaching events.
• Self-service access: employees can request a copy of their own events to support data subject access requests.

Data minimization checklist

• Default storage to redacted or metadata-only, and keep full for narrow, justified scopes.
• Keep retention short for content (30–90 days) and longer for metadata.
• Turn on responses: false unless you need response analysis.
• Review re-identification requests quarterly.