# Quorum — works council FAQ

_Quorum is a product of Creative Coders sp. z o.o., ul. Płk. Zoltána Baló 6 lok. 5, 02-793 Warszawa, Poland · KRS 0001271368 · Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy Krajowego Rejestru Sądowego · NIP 9512657914 · share capital PLN 5,000.00_

## Principles

- Quorum never evaluates, scores or ranks an individual. Analytics operate at organization, team and meeting-series level; there is no per-person score, ranking or productivity metric, and no feature may add one.
- Quorum is read-only on calendars. Its policy rules are measurement, never enforcement: it holds read-only calendar scopes, so it cannot create, move, decline or cancel a meeting. Only the organizer changes a calendar.
- AI recommends, a person decides. A recommendation and the organizer's decision are stored separately. Cost, health scores and savings are deterministic code — no model produces a number.
- Sensitive meetings are reduced at ingestion, not hidden in the interface. A 1:1, review, pay, hiring, disciplinary, medical, HR or legal meeting keeps only its time — no participants, attendance, cost or AI output.
- Written work is counted, never read. Message, comment and description text is discarded on arrival; conversations are stored as counts, participants and timestamps, and there is no per-person message count anywhere.

## Privacy floors

| Floor | Threshold | What it withholds |
| --- | --- | --- |
| Team size | 3 active people | Per-person rates (meeting hours per person per week, share of the week in meetings), focus figures, the team efficiency grade and the load band. A team below the floor is left off the Load screen entirely and only the number of such teams is reported. The company-wide row is gated on the same floor. Cost totals are deliberately not gated: what a unit committed to in meeting invitations is a budget fact about the unit, not a rate or a score about a person. |
| Response-time sample | 5 conversations and 3 people | Time to first response for a team, repository, Slack or Teams channel, Jira project, Linear team or GitLab project. Below 5 conversations, or 3 distinct participants, the figure is withheld; a team's figure also needs 3 active members. Quorum never reports who answers slowest. |
| Distribution cohort | 10 people | The distribution of weekly meeting time across the analysed population — a median and the share above a stated threshold. Below 10 people nothing is shown. No percentile above the median is published at any size, because near the top it describes one person's week. |
| Attendance coverage | 80% of a team's measurable meetings measured | The team grade. This is an evidence floor rather than a privacy floor: below it the grade is withheld with the reason, because it would rest on too few measured meetings. Meetings no platform can measure (no conferencing link, or a platform the workspace has not connected) are outside the basis and stated beside it. |
| Author digest lifetime | 30 days at most | The keyed digest of a conversation's author (see below) is deleted when someone else answers, and in any case after 30 days. |

## What each source sends

| Source | What Quorum processes | What it never processes |
| --- | --- | --- |
| Calendars — Microsoft Outlook (Graph) and Google Calendar | Event title and description, start and end, recurrence, join URL, organizer, invitee list and RSVP status, through read-only calendar permissions. Every invitee's copy is merged into one meeting so it is priced once. | No event is created, changed, declined or cancelled. A meeting whose title or description matches a private topic is reduced to its time before it is stored. |
| Meeting platforms — Microsoft Teams, Google Meet and Zoom | Join and leave times per participant, to measure what a meeting actually cost. Transcript speaker segments only if an administrator switches transcript analysis on; it is off by default. | No bot joins a call and Quorum fetches no audio or video. Google Meet attendance is excluded from every named person view. |
| Slack | Member ids and work emails, to match accounts (only matches are kept), and delivery of Quorum's own messages. After a separate administrator opt-in, reply events from public channels Quorum is invited to: an event id, a count, a timestamp, the mapped participants and the channel's name. | Message text arrives in Slack's event envelope and is discarded at the request boundary — never stored, logged or sent to a model. |
| Microsoft Teams channels | After a separate administrator opt-in and each team owner's consent: message and thread ids as opaque receipts, times, participants matched by work email from the Teams roster, and the channel and team names. | Message text is discarded on arrival — never stored, logged or sent to a model. |
| GitHub | Signed webhooks and count-only queries for the repositories an administrator connects: participant logins, titles, timestamps, state and comment totals. | Comment bodies and code are never requested or stored. |
| Jira, Linear and GitLab | Signed webhooks for the sites, workspaces and projects an administrator adds: the issue or merge request key and title, ids, dates, state, and participants mapped to colleagues. | Descriptions and comment bodies are discarded on arrival. Confidential GitLab issues are ignored. Quorum makes no request back to these vendors. |
| HRIS — through Merge or Kombo | Work email, name, job title, employment status and dates, reporting manager references and group memberships, through a read-only connection, to keep the directory current. | No payroll, private contact details, bank data or raw HRIS responses. Reporting lines do not grant dashboard permissions by themselves. |
| Cost bands | An hourly rate per band and which band each person is in, entered by an administrator. The only input that turns hours into money. | Never inferred and never fetched from a payroll system. |
| AI analysis (Google Gemini and/or OpenAI), when enabled | Meeting title, agenda and invitee roles, to recommend who needs to attend live; for the assistant, a sheet of team-, series- and workspace-level figures the reader can already open. | Never sensitive-meeting content, never a per-person figure. Without AI analysis nothing is sent to any model. |

## Per-person data, stated plainly

### The conversation author fingerprint

Some sources (a Teams reply, a Jira or Linear comment) do not say whose conversation a reply belongs to. To tell an answer from the author's own follow-up, Quorum holds a keyed one-way digest of the author, salted with that one conversation, so it cannot be matched across conversations. It is deleted as soon as someone else answers, and after 30 days at most. It is never shown anywhere.

### Private-time blocks

When a private meeting is reduced to its time, each person whose calendar holds it keeps a block with only their start and end — no meeting, title, event or other person. Blocks are read only to compute meeting hours and focus for teams of at least 3 active people, and to show the same person their own hours in My week. They never appear per person to anyone else, per meeting, in the heatmap or in any money figure.

### Named calendar commitments for workload planning

Administrators, and managers for people in their own team subtree, can see a person's calendar commitments and factual participation in meetings, to plan workload. These are facts, not scores: there is no rating, ranking or productivity figure, and they are not offered as a sort key. Google Meet attendance is excluded from these views.

### My week: each person's own figures, for that person only

Every person can see their own last week and a four-week trend — meeting hours (private meetings as time only), share of the working week, focus days, back-to-back stretches, invitations not joined, written threads and the recurring meetings they organize. Only that person can open it: not their manager, not an administrator, not the assistant, and it is in no report, export, audit entry or log. It is computed when opened and not stored. It shows no score and names no colleague; the only comparison is with the person's own team aggregate, and only when the rest of the team is at least 3 people. Administrators can switch sign-in to it off for employees without dashboard access, and each person can hide it.

### Attendance recommendations

With AI analysis on, an invitee can receive a private recommendation about whether a meeting needs them live. It is a suggestion about a meeting, not an assessment of the person, and nothing changes unless the organizer acts.

## Retention

| Data | How long it is kept |
| --- | --- |
| Meetings, attendance, recommendations and decisions | 365 days by default; each workspace sets its own window in Settings. A daily job deletes everything older. |
| Conversation volume (counts, participants, timestamps) | The same window, 365 days by default, measured from the last message. |
| Private-time blocks | The same window as meetings, and deleted when the person is erased or the workspace is deleted. |
| My week settings (hidden, weekly message on or off) — the figures themselves are never stored | Until the person changes them; deleted when the person is erased or the workspace is deleted. |
| People who have been deactivated | Erased by the daily job once deactivated longer than the workspace's window (the meeting window, 365 days by default, unless an administrator sets a separate one). Past meetings keep an anonymous participant in their place, so their size and stored cost do not change. |
| Conversation author digest | Until someone else answers, and never longer than 30 days. |
| Transcripts (only if switched on) | 30 days by default — the shortest window, because it is the most sensitive record. |
| Assistant usage (time and outcome; never the question or answer) | 90 days, or the workspace window if that is shorter. |
| Operational records (job logs, calendar copies used to merge invitations, model inputs) | Fixed windows enforced by the same daily job, independent of the workspace setting. |
| Workspace export archives | Encrypted while they wait to be downloaded, and deleted after 7 days. |
| Everything, when the workspace is deleted | Deleted 14 days after an administrator (or, at contract end, Quorum) asks, unless an administrator cancels. Only a record that the deletion happened remains, and the audit trail until its own window ends; backups allow recovery for 3 days. |

## Works council FAQ

### Is Quorum a performance-monitoring tool?

No. It measures what meetings and written threads cost a team and recommends where fewer people need to be live. It produces no per-person score, ranking or productivity metric, and its own rules forbid adding one. Google's Meet terms prohibit using Meet data for performance tracking, and Quorum applies that rule to every provider.

### What is the smallest group Quorum reports on?

Per-person rates, grades and load bands need a team of 3 active people; response times need 5 conversations and 3 people; distributions need 10 people. Below a floor the figure is withheld, not estimated. Cost totals are reported at any size, because they are budget facts about a unit rather than measurements of a person.

### What can a manager see about an individual?

Calendar commitments and factual participation for people in their own team subtree, for workload planning, excluding Google Meet attendance. No score, rating or ranking, no person's private meetings — those exist only as time inside team totals — and never anyone's My week, which only its own person can open.

### Can Quorum change, decline or cancel meetings?

No. It holds read-only calendar permissions. Meeting policy in Quorum is measurement: it reports how a calendar compares with the rules you declare, and the organizer decides what to change.

### Does Quorum read what employees write?

No. Slack, Teams, Jira, Linear and GitLab deliver text with their events; Quorum discards it on arrival and keeps counts, times and participants. GitHub is queried for counters only.

### Does AI decide anything about employees?

No. AI is optional and only recommends whether a meeting needs a given invitee live. The organizer's decision is stored separately and nothing changes unless they act. AI never sees sensitive meetings and never produces a cost or a score.

### How long is data kept?

365 days by default for meetings, attendance and conversation volume, 30 days for transcripts if they are switched on, and 30 days at most for an author digest. People who have been deactivated are erased after the workspace's window. A daily job enforces it; the windows can be set in Settings and agreed with you. Employees can download their own data from My week, administrators can erase a person or export the whole workspace, and deleting the workspace deletes everything after a 14-day cooling-off.

### What can be agreed in a works agreement?

Which sources are connected, whether the optional sources (Slack or Teams channel tracking, transcript analysis) are switched on, the retention windows, and whether the workspace assistant is available are all workspace settings. Policy, cost-band and access changes are recorded in an audit trail visible to administrators in Settings.