Cestani
Institutional Privacy & Cryptographic Architecture

Cestani Privacy Statement

Effective Date: August 15, 2026 · Version: 1.0 (Normative Standard)

1. Foundational Commitment: Institutional Sovereignty

Cestani is designed for universities, governing boards, public bodies, and mission-critical institutions where privacy is not merely a legal checkbox, but a prerequisite for authentic governance and candid leadership feedback.

Zero External Tracking: Cestani contains no third-party analytics scripts, no advertising beacons, no social media tracking pixels, and no third-party content delivery networks (CDNs). All assets, fonts, and scripts are self-hosted directly on your institution's private virtual private cloud (VPC).

2. The 6-Tier Graduated Privacy Engine

In accordance with Cestani Binding Copy Conventions, we never use "anonymous" as a vague marketing label. Every instrument, motion, and questionnaire explicitly declares its mathematical privacy tier, specifying exactly what data is retained, who can link it, and how it is protected:

Tier Privacy Model What Is Retained Who Can Link Identity
Tier 1 Fully Attributed
(e.g. Roll-Call Votes, Self 360, Direct Supervisor Reviews)		 Voter/Respondent email, verified name, exact timestamp, choice. Public or Authorized Institutional Administrators.
Tier 2 Pseudonymous with Key Escrow
(e.g. Committee Secret Ballots)		 Ephemeral pseudonym, encrypted identity envelope held in quorum escrow. Nobody, unless a formal multi-party quorum unseals the audit envelope.
Tier 3 Cryptographically Decoupled Anonymous
(e.g. Peer 360 Evals, Secret Ballots)		 Decoupled response record, coarse timing bucket. Zero identity foreign key. Nobody. The database physically separates tracking from responses.
Tier 4 Zero-Knowledge Homomorphic Ballot
(e.g. Cryptographically Verifiable Elections)		 Homomorphically encrypted ciphertext with ZK-proof of validity. Nobody. Tally is computed without decrypting individual ballots.

3. Identity & Login-Gate Decoupling

When an evaluation or ballot campaign requires authentication (e.g., via Google Workspace, Microsoft 365, or Institutional SAML/OIDC):

  • Authentication as a Transient Gate Key: The verified email is checked in memory solely to confirm that the visitor holds a valid entitlement token.
  • Zero Response Linkage: The authenticated email is held only in an ephemeral session cookie and is never written to the anonymous response storage.
  • Single-Use Invalidation: Once the response is submitted, the tracking token is marked COMPLETED in the identity store, while the answer is written to an independent, unjoined response store with a newly generated UUIDv4.

4. Anti-Correlation & Timing Protection

In traditional survey platforms, high-precision submission timestamps (e.g. 2026-08-15 14:22:07.123 UTC) can allow administrators to cross-reference server access logs with evaluator calendar availability to deanonymize respondents.

Coarse Lateness Bucketing (Anti-Correlation Constraint)
For all Tier 3 anonymous evaluations, Cestani writes submission_date = NULL and stores only coarse lateness buckets (e.g. "on-time", "wk:1", "wk:2"). High-precision timestamps are mathematically eliminated from anonymous records.

5. Small-Group Anonymity & Cell Suppression

When reporting aggregated 360 leadership feedback or committee ballot distributions, Cestani enforces automated Small-N Suppression:

  • Anonymous relationship categories (e.g. direct reports, skip-level reports, internal peers, external peers) with fewer than 3 respondents are automatically withheld from web reports.
  • When suppressed, the system clearly states: "Results are not shown because the minimum anonymous group size was not met." Precise small counts are never revealed.

6. Data Security & Encryption Architecture

All data processed by Cestani is governed by strict technical controls:

  • In Transit: Enforced TLS 1.3 with HSTS (HTTP Strict Transport Security) and modern cipher suites.
  • At Rest: PostgreSQL physical volume encryption and encrypted secret stores with strict file permissions (chmod 0600).
  • Role Separation: Internal database roles (identity_role vs. anon_response_role) enforce least-privilege access so web reporting endpoints cannot perform unauthorized joins.

7. Data Retention & Institutional Governance

Cestani is a self-hosted platform operated under the direct governance of your institution. Your institution remains the sole Data Controller. Data is retained according to your institution's official record retention schedules and can be purged, archived, or exported at the direction of authorized institutional officials.

8. Contact & Questions

For inquiries regarding Cestani's privacy architecture, cryptographic audits, or institutional deployment configurations, please contact:

Cestani Governance & Security Office
info@cestani.com · privacy@cestani.com