Custody rule
1. What this rule governs
The November 2026 employee survey site, its database (survey on the arcadia-pg instance in the bos-arcadia Google Cloud project), its backups, its exports, and every person who can reach any of them. The survey asks W-2 employees for both parts and 1099 contractors, by request, for the anonymous part only. The rule applies from the day the first link or phrase is sent until the data is deleted or carried into its successor as §6 says.
2. Roles
| Role | Who | May |
|---|---|---|
| Custodian | the CEO, one account | run the campaign; read self-assessments; read raw anonymous answers; export; delete at close |
| Platform administrators | the holders of Owner or Editor on the bos-arcadia project (the Google Cloud org administrator; the Arcadia operators) | administer the infrastructure. Not read the survey tables, not restore, clone or export the survey database, not query it through any tool, not read its backups, during the window or after it |
| A person's managers | the people manager and the project managers of a W-2 employee | receive that person's self-assessment from the custodian as an input to the performance review; nothing anonymous beyond the summaries of §5 |
| External counsel | the firm the CEO engages | review the process before launch; advise on how findings are used; receive what the custodian chooses to share |
| Employees and contractors | the W-2 roster, and the contractors sent the contractor phrase | their own self-assessment (W-2 employees); their own anonymous answers while on screen, never afterwards (not retrievable for anyone by design) |
3. Who sees what
| Material | Custodian | Other leaders | Administrators | Counsel |
|---|---|---|---|---|
| Raw anonymous answers | yes | never | technically possible, forbidden (§4) | only what the custodian shares, with counsel's confidentiality |
| Paraphrased themes and scores per area | author | yes, for their assessment | no | yes |
| A person's self-assessment | yes | the person's managers, as an input to that person's performance review; no other leader | technically possible, forbidden | on request of the custodian |
| Who has and has not completed each part | yes (daily snapshot) | no | no | no |
| When a self-assessment was submitted | yes (a date, by name) | no | technically possible, forbidden | on request of the custodian |
| When anyone answered anonymously or confirmed completion | no: no date or time is recorded on any row | no | only aggregate per-minute operation counts in Cloud Monitoring, with no content and no identity (§4) | no |
4. What administrators undertake
Each administrator with access to the project acknowledges this rule in writing before the window opens. They will not read, copy, restore, clone or export the survey database or its backups, and will not read Cloud SQL logs for it, except to resolve a declared outage, and then only with the custodian informed in advance and counsel informed the same day. The custodian reviews Google Cloud Audit Logs weekly during the window and at close for any restore, clone, export, import, SQL sent through the Cloud SQL Admin API or database-user change on the instance; any such event is reported to counsel.
Four further facts are part of this undertaking. The Cloud SQL instance's settings that would record statements, their parameters, their timing or commit times (log_min_duration_statement, log_statement, pgAudit, track_commit_timestamp, log_parameter_max_length_on_error, auto_explain, log_duration, log_connections, log_disconnections, log_lock_waits) stay off and are pinned by the infrastructure tests. Cloud SQL Data Access audit logging is on for the project, so every export, import, restore, clone, SQL sent through the Admin API and database-user change on the instance is an audited event, read weekly by an account that holds the Private Logs Viewer role; the one declared exception to the undertaking above is the pilot's proof of that trail: a single export request of the instance's postgres database, which holds no survey data, made before the real campaign exists, with counsel told first, aimed at a bucket name made up on the spot that nobody owns so that it fails without moving any data, and visible in the weekly review; a read of the live table over the bastion leaves no such entry, which is why the undertaking above, not a log, is the control for reads. Cloud Trace is disabled for the project before the pilot and re-checked weekly (the infrastructure never enables it), so no sampled per-request timing exists outside the excluded request log. Cloud Monitoring's per-database row-operation metrics record, per minute and for several weeks, when rows were written, with no content and no identity, so an administrator with monitoring access can see when submissions arrived but never what was said or by whom.
Anonymous answers are stored apart from anything that names a person, and their storage order is scrambled every night at 04:30 UTC, before the daily backup. Until that night's scramble, the live table holds the day's answers in the order they arrived, and point-in-time recovery can rebuild the database as it was at any moment of the last seven days; rows that arrive between the scramble and the backup, or a whole day's rows after a failed scramble, sit in arrival order in that day's backup. Linking an answer to a person would therefore take deliberate, privileged work on the live database that day, or a restore to an earlier moment. A restore or clone is an audited event; a read over the bastion is not; this rule forbids both. Database error logs are kept briefly and are designed never to contain survey answers. With a shared phrase, duplicate anonymous submissions are possible; they show in the daily count as a number above the number of people who received a phrase, never as a name.
5. Raw text handling
Only the custodian reads raw anonymous text. Nothing is read back to anyone, quoted, or shown. Before any action based on anonymous content, including feedback to a leader, the custodian consults counsel on how the material is used, and shares themes paraphrased so that writing style and specific incidents cannot identify the author. The summaries given to leadership, and the summaries archived under §6, are written the same way: no single person can be identified from them.
The contractor phrase, which opens the contractor questionnaire of the November campaign, goes only to 1099 contractors, in one message to all of them. Every anonymous row records which questionnaire it answered, so contractor answers are known to be a contractor's, though not whose. No result broken out by group reaches other leaders unless at least five contractors answered, and the custodian reads raw contractor rows under the same rule as every other raw row.
6. Retention
- Exports: taken by the custodian at close and held in [location to be named by the custodian]. The anonymous exports are shared with counsel as needed and never with other leaders; the anonymous and confirmation exports, and any copies made from them, are deleted with the database rows at the next survey. The self-assessment exports go to a person's managers only as §3 says, and they are the source of the archive described below.
- Anonymous answers and the confirmation flags: kept until the next survey, for comparison, then deleted. Summaries that identify no one may be kept indefinitely as part of the company's metrics and the protocols and procedures they lead to; the anonymity of any one person is maintained throughout.
- Self-assessments: kept for the duration of the person's employment, so that they can track their progress and responses; archived from the close export, with the roster that names them, as personal data under the same custody as the company's other personal information, and carried into the successor system with the same protections. They leave this site's database with the rest of the campaign's data at the next cycle.
- Personal links: deleted 90 days after the window closes. The roster stays with the self-assessments it names.
- Database backups: seven days, automatic, then gone.
- The pilot campaign used for counsel's walkthrough: its live data deleted before the real campaign is created; its backups age out within seven days; the custodian's audit rows for it remain (they name the campaign and counts, never an answer).
7. Employee rights
Any employee may ask their manager or HR to see their own self-assessment at any time while they are employed; the request is passed to the custodian, who provides it to them from the archive. Anonymous answers cannot be retrieved for any employee or contractor by anyone; that is the design, not a policy.
8. If something goes wrong
A suspected attempt to link an anonymous answer to a person, or any unexpected access to the database or its backups, is reported to counsel the same day; audit logs are preserved; employees and contractors are told what happened and what it means once counsel has advised.