Trust and security for corporate pilots

Signed-in host accounts use Auth0-backed Convex Auth. Account identity is used for saved templates, custom themes, account export, and account deletion boundaries.

Host control is still Run-scoped. The server checks host control credentials for privileged Run operations, and the backend stores host control, recovery secret, and recovery code values only as hashes.

Players can join by code or link without creating a Discera account. Player participation data is scoped to the live Run and browser session rather than a cross-event player profile.

Run participation can include nickname, avatar choice, answer submissions, audience posts, and session proof used for rejoin or recovery during the event.

Finished and cancelled Runs and associated rounds, players, answers, generated content, and uploaded Run assets are retained for an approved 1, 7, 30, 90, or 365-day attached Event override, workspace or organization default, falling back to 30 days, then cleaned up by scheduled backend cleanup.

Retention policy resolution can enforce organization constraints, but Discera does not offer an enterprise-wide buyer retention administration UI in Trust Lite.

Signed-in hosts can export local Discera account data from the account page. The export covers account profile fields, auth account references, saved templates, custom themes, retained Run metadata, and uploaded media references.

Local account deletion removes Convex account data, saved templates, mutable Activities and Formats, custom themes, account entitlements, and unreferenced uploads. Retained Runs keep only an anonymized immutable Activity snapshot, which expires with the final referencing Run. Auth0 identity deletion is handled manually by an operator through privacy support.

For signed-in hosts who accepted analytics, deleting the local Discera account does not automatically remove the PostHog person profile or consented product-event history linked to the account. Any consented session replays are retained separately and are not removed by local account deletion. PostHog analytics and session replays are typically retained for up to 12 months. Email privacy@consensus.dk to request operator-handled removal of the PostHog person profile, associated events, and session replays.

• For a participant linked by email to a private Audience roster, an authorized workspace or organization controller verifies the participant outside Discera. The controller can then search the roster and Run links, export complete JSON and CSV records, or start erasure. Run records are included only where the host explicitly linked the roster entry to that participant's player record during the Run.
• Erasure removes covered identifying active product data and invalidates Discera-held workspace export packages before issuing a minimal non-identifying receipt. An active legal hold suspends erasure, and releasing the hold resumes it.

• The controller workflow is keyed on a roster email. It cannot find, export, or erase a participant who joined with only a nickname and was not linked to that roster.
• Those records remain until the Run expires under its approved 1, 7, 30, 90, or 365-day Event, workspace, or organization retention policy, with a 30-day system fallback. Contacting the host can identify the relevant Run and controller, but does not create an individual erasure path. A host can end or cancel an ongoing Run to start ordinary retention, but current host controls cannot immediately delete a retained Run or shorten an expiry already recorded for a finished or cancelled Run.
• Processor backups follow separately disclosed retention windows. Files already downloaded by a controller and cards already delivered to the customer's Microsoft Teams destination are outside Discera's recall control and follow the controller's or Microsoft's configuration and policy.

• Pre-display review queues for answer types and audience surfaces where moderation is enabled.
• Panic hide for suppressing audience-contributed content from shared player and presentation screens.
• Display-name blocking with host or moderator review for override decisions.
• Run-scoped moderator sessions that can be named, audited, and revoked.
• Finished-Run exports that include moderation audit coverage where those surfaces are present.
• Public mutation rate limits and repeated-abuse lockouts at a high level.

• No player mute or player reporting controls today.
• The profanity filter is deterministic and term-based, so it is a backstop for review rather than comprehensive multilingual or evasion-proof filtering.
• Host-created quiz content is not comprehensively filtered before display.
• There is no moderation analytics dashboard today.
• After score-bearing results are finalized, takedown changes visibility only; finalized scores are not recomputed.

Discera collects operational diagnostics to support investigation of production failures and live Runs. This is operational telemetry, not advertising. Diagnostics can include route, browser, request, error, and pseudonymous browser-session context needed to troubleshoot failures. Run routes are reduced to templates; raw join codes, internal Run IDs, and gameplay session IDs are excluded or redacted.

Localization failures are reported whether analytics consent is accepted, declined, or unset. Their allowlisted diagnostic fields contain only a diagnostic code, requested and fallback locales, route template, application version, and deployment environment. PostHog adds only its public project token, a memory-only anonymous identifier, and a no-person-profile flag; the event excludes message content, interpolation values, and account or analytics identity.

Product analytics and PostHog session replay are separate from essential diagnostics. They only run after a visitor selects Accept analytics in the consent banner.

Product event payloads exclude internal Run IDs, raw join codes, and gameplay session IDs. PostHog still assigns pseudonymous analytics and browser-session identifiers.

If a signed-in host accepts analytics, Discera may attach the account ID and available account email or name to consented product events.

AI authoring is optional. When a host asks Discera to generate quiz content or answer options, Discera sends the relevant prompt, audience context, settings, question text, existing options, and optional source PDF content to OpenAI.

Website-based theme generation is also optional. When a host asks for it, Discera sends the submitted website or domain to Context.dev so the app can receive brand colors, title metadata, and logo candidates.

The processor disclosure summary lives on the privacy page. This Trust Lite page does not add special vendor contract commitments beyond those public disclosures.

Discera can run the core authoring and live-event product without OpenAI or Context.dev processing. For a no-AI pilot, AI-backed calls are blocked on the deployment and the unavailable authoring controls are omitted.

Manual content authoring, spreadsheet import, saved templates, manual theme editing, rehearsal, hosting, participation, presentation, and results remain available.

Paid AI requests pass through a server gate. In production, Discera derives a daily one-way rate-limit key from the client address observed by Vercel; the raw address is not sent to Convex or an AI provider. Shared public addresses can share a limit, and the key rotates at each UTC day boundary.

Pilot support runs through a named Discera contact agreed in the pilot agreement. For pilot support, sales, product support, or accessibility questions, email mab@consensus.dk. Privacy and data-rights requests use the address published on the privacy page.

Suspected security vulnerabilities go to mab@consensus.dk, monitored by Mikkel Abildtoft. Reporting does not require repository access or a pilot agreement. Acknowledgement is best-effort within a few business days, and there is no bug-bounty program.

For pilot support requests sent to mab@consensus.dk, we aim to acknowledge your request within two business days, during European business hours, Monday to Friday. This is a best-effort target, not a guaranteed response or resolution time.

For a scheduled pilot event, agree the named contact and a direct escalation channel before the event date. Discera does not provide automatic staffed event coverage.

Escalation that was not arranged in advance falls back to best-effort follow-up during European business hours.

Hosts should use the built-in recovery paths first: the host recovery code for a lost host session, player rejoin for a dropped participant, and the presentation retry path for a failing room display.

The documented setup calls for Convex backend exceptions to reach the same PostHog project as app diagnostics. Production backend forwarding has not yet been verified.

The documented alerting model covers new and reopened issues, spikes on existing issues, and exception-volume trends on live-Run routes. Production configuration and notification delivery have not yet been verified.

The documented P0–P3 severity model is keyed to whether a live event is affected. It reserves the highest internal severity for repeated failures during an active Run session, with the Run stabilized before deeper diagnosis. This is documented response guidance, not evidence of production alert delivery or staffed coverage.

Incident records use route templates, release versions, and request identifiers. Host control tokens, recovery secrets, and participant names are not recorded in them.