How CandorVoice works.

What this does

A Location is a physical site in your workspace. It anchors the employee feedback page, QR poster, feedback reminders, Polls, What changed, reports and manager scope.

Every Location has a stable CandorVoice reference such as LOC-12. That reference is assigned once and is what you quote in support, bulk files and invitations.

The fields

• Name — the site name people recognise.
• Address — optional; useful when several sites share a similar name.
• Timezone — used for reminder timing and report schedules.
• Active / inactive — whether the site can accept new employee Feedback.
• PIN protection — on by default; controls whether the employee page asks for the shared four-digit PIN.

Some workspaces also use a Location code from their own systems, such as STORE-1299. It is not the same as LOC-12: the code is yours, the LOC-N reference is CandorVoice's. Bulk files can use both.

How to add one Location

1. Open Locations.
2. Choose Add location.
3. Enter the name and any address or timezone you need.
4. Save.
5. Open the new Location or use QR & feedback link to reach its employee access tools.

The Location is active by default. Adding it does not print a poster or invite a manager.

How to edit

Open the Location row. The edit page is also the operational page: it shows the employee access state and the manager readiness area. Changes to name, address, timezone or PIN protection do not change the permanent QR code or short link.

Deactivation and reactivation

CandorVoice deliberately offers Deactivate instead of delete. Deactivating a Location:

• stops new employee Feedback immediately;
• shows employees a plain “Feedback is currently unavailable” page;
• keeps existing Feedback, Actions, Polls, What changed and history;
• keeps the same QR and short link for a later reactivation.

Reactivating restores the employee page. The current PIN is asked for again if PIN protection is on.

Searching and filtering

The Locations list supports search and filters, including Location Group and manager readiness. The list is paginated and searched in SQL, so a large estate does not load every Location into the browser.

Common scenarios

Opening 20 new stores. Use Bulk Operations to create the Locations and invite managers from one file, then print posters for the new sites. Do not add them one at a time if the file already exists.

A Location closes temporarily. Deactivate it. Do not delete it and do not rotate the QR. Existing history stays and the same poster works after reactivation.

Two sites share a name. Use the address or the LOC-N reference when talking to support, and consider a Location Group if they belong to the same region.

Important details

• The QR code and short link are permanent. Renaming the Location does not break printed material.
• A Location with no manager is a readiness problem, not a data problem. Check Manager status.
• You cannot see another workspace's Locations; workspace separation is enforced underneath every query.

What happens next

Adding a Location makes its public channel available immediately. Editing or deactivating it changes the employee page on the next request. A printed poster keeps working because the QR and short link are permanent.

Troubleshooting

A Location has no QR activity. Check whether the poster is visible, whether it has ever been printed, and whether the Location is active.

A Location has QR activity but no Feedback. A scan is an opening, not a submission. Employees may be reading without sending, or the PIN may be causing friction.

A manager cannot see the Location. Check the invitation state and the manager's Group or explicit Location scope.

Related features

• Employee feedback access
• Location managers
• Location Groups
• QR and poster workflow

What this does

Every active Location has a public feedback page that employees can reach without an account. The page can be opened from the permanent QR code or the printed short address.

The access rules

Two facts decide what an employee sees:

1. Is the Location active?
2. Is PIN protection on?

Inactive always wins. An inactive Location shows a short unavailable page and accepts nothing, regardless of the PIN setting.

When active:

• PIN protection on: employee enters the shared four-digit PIN, then writes Feedback.
• PIN protection off: employee goes straight to the form.

What the PIN is

The PIN is a shared access code printed beside the QR. It is not an employee login and does not identify the person. Three incorrect attempts lock that Location's PIN gate for 60 seconds. A correct PIN clears the count immediately. The screen counts down and the server re-checks the lock on every request.

Changing the PIN does not change the QR code or the short link. It does mean that any printed material showing the old PIN needs replacing.

Named or anonymous

Anonymous is the default. The employee can choose Share my name, which reveals the name and optional email fields. Anonymous Feedback has no stored identity to recover later.

What employees see

After the Location gate, the employee page is mobile-first and has two halves:

• Share — the Feedback form, open by default.
• What changed — published management updates for that Location.

After sending, the employee sees a confirmation and can share another thought. A private follow-up link and Password may be offered so the employee can return to a conversation without an account.

Bot protection

A deployment can enable a human-verification check on public writes. It runs on the server, does not store an address or device identity, and does not challenge reading the page or What changed. If verification fails, the employee's typed Feedback and Category remain on the form.

Common scenarios

Safety issue. The employee scans the poster, enters the PIN, chooses the Safety Category and sends the observation. They may stay anonymous.

Anonymous concern about a manager. The employee can submit without a name. Management can still read and act on it; it must not try to infer who wrote it.

A site is out of service. Deactivate the Location. The page closes for both Share and What changed until the site is reactivated.

Important details

• A correct PIN does not reveal the Location before it is entered; the gate is deliberately generic.
• The QR encodes the destination, never the PIN.
• A scan is one anonymous opening. It is not proof that a person submitted Feedback.
• Private follow-up is separate from the Location PIN. The follow-up Password reopens one conversation, not the feedback form.

What happens next

A correct PIN opens the Location page. A sent observation follows the named or anonymous choice. A failed PIN or verification attempt does not create a submission. A deactivated Location closes the page.

Troubleshooting

The employee says the PIN is wrong. Confirm the PIN shown on the current poster and wait out the 60-second lock after three failures.

The employee sees an unavailable page. Check whether the Location is active.

The employee wants to stay anonymous but the form asks for a name. They may have turned on Share my name; anonymous is the default.

Related features

• Locations overview
• Feedback inbox
• QR and poster workflow
• Privacy and anonymity

What this does

The Locations list shows whether a site has somebody responsible for it. This is a readiness signal: a live feedback channel with no manager is unlikely to stay active.

The states

Multiple managers

A Location can have more than one registered manager. This is useful for shift coverage, a site lead plus a regional manager, or a handover. The Locations list summarises the group, for example 2 registered · 1 invited.

One person across several Locations

One person can manage many Locations. Use a Location Group when the set is stable and you want future Locations added to the Group to fall inside the same access. Use explicit Location access when the person should see a fixed list.

How to add a manager

1. Open the Location or Team → Invitations.
2. Enter the email and choose the role.
3. Choose the Locations or Group.
4. Send the invitation.
5. Check Invitations until the state becomes Registered.

Common scenarios

A manager has not accepted. The Location shows Invited, not Registered. Check the address, resend after the cooldown, or contact the person. Do not assume access exists.

An invitation expired. Resend it if the product allows, or create a fresh invitation. An expired invitation is not a membership.

Replace a manager without removing existing access. Add the new manager first, confirm they registered, then remove or narrow the old membership if that is the intended change. Adding one person does not remove another.

Important details

• A pending invitation is not a ghost user. The person appears under Invitations, not Users.
• The primary manager marker is metadata; it does not grant extra permissions.
• A manager's access is re-checked on every request, so narrowing a scope takes effect immediately.
• Resend keeps the same invitation and scope; it does not create a second membership.

What happens next

An invitation moves through Invited, Registered, Expired, Send failed or Revoked. Only Registered is a workspace user with access. A resent invitation keeps the same offer and scope.

Troubleshooting

The manager still shows Invited. The person has not accepted; they cannot sign in yet.

Resend is unavailable. Check the cooldown, or whether the invitation is registered, revoked or expired.

The Location has two managers and only one can see it. Each manager has their own role and scope; adding one does not change the other.

Related features

• Team and invitations
• Invitation lifecycle
• Location Groups
• Roles and scope

What this does

A Location Group is an optional named collection of Locations, for example a region, a brand, a cluster or an operating unit. It makes a large estate easier to filter and is the simplest way to grant a manager access to a changing set of sites.

What a Group is not

• It is not a second workspace.
• It is not a Region and does not replace Location scope.
• It does not create a new role or a separate dashboard.
• A Location can belong to at most one Group; a Location with no Group is Ungrouped, which is a normal state.

How to use one

1. Create the Group and give it a name.
2. Add the Locations.
3. Use the Group filter on Locations, Feedback, Actions, QR & Posters and reports.
4. Grant a manager access to the Group when they should follow its current Locations.

Every Group has a stable reference such as GRP-4. The reference is used by bulk files and exports.

Common scenarios

A regional manager covers 12 stores. Put the stores in the region's Group and grant the manager the Group. A store added later is covered without re-inviting the manager.

A temporary project spans three sites. Create a project Group for filtering and reporting. If it is only a filter, no access change is needed.

A Location moves regions. Move it to the new Group. A manager who had access only through the old Group loses access immediately; a manager with explicit access keeps it.

Important details

• Group access is dynamic. It covers the Locations currently in the Group, not a frozen list.
• A Group-scoped manager's reports and Ask CandorVoice answers use the same Group scope.
• Groups belong to one workspace and are never visible to another workspace.
• The Locations directory export includes group_id and group_name, not internal database identifiers.

Common mistake

Using a Group as if it were a permission. The Group is a container; the membership's Group access is what grants scope.

What happens next

A manager with Group access sees the Locations currently in that Group. A Location added to the Group is covered on the next request; a Location removed from it leaves that manager's scope immediately.

Troubleshooting

A manager lost a Location after a Group change. The Group no longer contains it. Use explicit access if the manager should keep it.

A report includes a Location the manager cannot open. Check the report's scope and the manager's current Group/Location access.

Related features

• Locations overview
• Roles and scope
• Bulk Operations overview
• Reports overview

Employees cannot submit

Check in this order:

1. Is the Location active? An inactive Location closes the whole employee page.
2. Is the QR or short link reaching the right Location? Open it yourself.
3. Is PIN protection on? If so, does the printed material show the current PIN?
4. Has the PIN gate locked after three wrong attempts? Wait 60 seconds.
5. Is the deployment using human verification, and is it temporarily unavailable? The employee should see a safe message and keep their typed text.

A manager cannot see a Location

Check:

• Is the invitation Registered, or still Invited/Expired?
• Does the membership include that Location, a Group containing it, or all Locations?
• Was the Location moved out of a Group the manager relied on?
• Is the manager using the right workspace?

Do not fix a scope problem by giving the person workspace-wide access unless that is genuinely intended.

A Location looks quiet

Quiet is not proof that nothing is wrong. Check:

• QR activity: has the poster ever been scanned?
• Is the poster visible and recent?
• Has a manager registered?
• Are reminders configured or is the channel only mentioned once?
• Is the site seasonal or temporarily closed?

The QR no longer works

The Location QR and short link are permanent. Check that the Location is active and that the poster is not damaged. Do not rotate the QR to fix a PIN problem; the QR does not contain the PIN.

Important details

• Deactivation stops new Feedback but keeps history.
• Adding a manager does not remove another manager.
• A Location can be ungrouped and still work normally.
• Support can investigate with the LOC-N reference, the page, the time and the safe error text. Do not send PINs or employee Feedback unless necessary.

Related features

• Employee feedback access
• Location managers
• Support

What this does

The public feedback page lets an employee share an observation without an app, account or training. It is text-only and mobile-first.

The flow

1. Employee scans the Location QR or opens the printed short address.
2. If the Location asks for it, they enter the shared four-digit PIN.
3. They choose a Category and write the observation.
4. They leave Share my name off for anonymous Feedback, or turn it on and provide a name and optional email.
5. They send.
6. They see a confirmation and can share another thought.

What the employee sees

• The page names the Location after the PIN gate.
• The form is short: Category, message, and the identity choice.
• Anonymous is the default.
• After sending, the page offers a private follow-up link and Password when the conversation feature is available.
• The employee page also has a What changed half for published updates.

What management sees

The observation appears in Feedback with a reference such as FB-8, the chosen Category, the message, the Location, the identity choice, priority, review state and any linked Actions.

Common scenarios

A safety issue. The employee chooses Safety, describes the hazard, and may stay anonymous. Management should treat the observation as a report to investigate, not as proof of exactly what happened.

A process improvement. The employee describes a slow handover. Management can review it and create an Action if the change is worth doing.

Praise. A positive observation is still Feedback. Review it; no Action is required.

A harassment concern. The employee may choose anonymous. Management should follow its own safeguarding and investigation process; CandorVoice records the observation but does not decide whether harassment occurred.

Important details

• The Category is the employee's own choice. CandorVoice does not silently reclassify it.
• Priority is a management urgency marker; it is not the employee's chosen Category.
• The Location PIN is shared and does not identify the employee.
• A failed send should leave the typed text on the form. If it does not, note the exact message and contact support.
• Anonymous means CandorVoice has no stored identity to recover. Do not ask the employee to reveal themselves later unless they choose to.

What happens next

The observation is stored for the Location and appears in the management inbox. The employee's chosen Category and identity choice are kept. A private follow-up is available if the employee kept the link and Password. Nothing is published to employees unless management later creates a What changed update.

If the Location is inactive, the form is not available at all. If the send fails, the employee should see a safe error and keep their text; note the exact message and contact support if it repeats.

Related features

• Feedback inbox
• Employee feedback access
• Privacy and anonymity

What this does

Feedback answers: what are employees telling us? It lists observations from the Locations the viewer may see, newest activity first.

What a row shows

• reference (FB-N);
• Category;
• the message, with Location, identity and time underneath;
• Priority;
• reply state;
• linked Action or Actions;
• review state;
• created time.

Opening an observation

The detail page shows:

• the full message;
• Category and Priority;
• Location and received time;
• the identity the employee chose;
• review state;
• linked Actions;
• Private follow-up when the conversation feature applies.

Create Action is the primary action when work is needed. Follow up opens a private conversation. Mark reviewed records that management has read and handled the observation. Set priority changes urgency.

Review states and replies

New means the observation has not been reviewed. Reviewed means reviewed_at is set. Reviewed observations stay in the list.

If an employee replies to a private follow-up, the row shows New reply and returns the observation to the top of the activity order. Opening the conversation clears the new-reply state.

Filters and search

Use the status filter (All / New / Reviewed), Location filter, Category, Priority and search over the message. Saved views can remember a personal combination of filters, search and sort.

Common scenarios

A safety issue with no Action. Open it, create an Action, assign an owner and target date if appropriate, then mark the observation reviewed.

An observation that needs no work. Read it, mark it reviewed, and move on. Do not create an Action just to make the row look complete.

An employee replies privately. The row becomes New again. Open the conversation and decide whether the response changes the Action or the review.

A manager needs a second opinion. Use the private follow-up to ask a clarifying question; do not publish the employee's message internally.

Important details

• The inbox respects Location scope. A manager cannot widen it with a filter.
• Deactivating a Location does not remove its historical Feedback.
• Priority is a management judgment, not an AI classification of the employee's Category.
• The product reports submissions, not distinct employees. Do not say “17 employees reported this” unless you have a different, proven source.
• A private follow-up is not a public reply and does not appear on the employee's What changed page.

What happens next

Marking reviewed changes only the review state. Creating an Action links the observation to work. A private follow-up opens a separate conversation. None of these publishes anything to employees; that requires an explicit What changed update.

Troubleshooting

A manager cannot see an observation. Check the Location scope and whether the observation belongs to a Location outside their Group or explicit list.

An observation disappeared from the normal list. Check whether it was classified as Spam. Spam keeps the original observation and can be restored with Not spam.

The row says New reply. The employee has replied privately. Open the conversation; the new-reply state is cleared when it is opened.

The message is empty or unexpected after an export/open. Treat the CSV as a working copy outside CandorVoice and verify the row against the live record. Do not try to repair data by editing the export.

Related features

• Review, priority and Actions
• Feedback export
• Actions overview
• Spam review

What this does

Reviewing is a small operational habit: read the observation, decide whether it needs work, and record the decision.

A simple review routine

1. Open Feedback and choose the period or filter you need.
2. Read the newest and highest-priority observations first.
3. Decide: does this need an Action, a private follow-up, or no further work?
4. If it needs work, create the Action from the observation so the evidence is linked.
5. Mark the observation reviewed once it has genuinely been handled.

Priority

Every new Feedback starts at None. Management may set Low, Medium, High or Critical to describe urgency. Priority is not the employee's Category, it is not assigned from that Category automatically, and it is not a prediction of whether something happened.

• Critical: immediate attention needed, especially for safety or a serious operational risk.
• High: should be looked at promptly.
• Medium: normal management attention.
• Low: useful context or a small improvement.

Linking an Action

Create Action on an observation opens the canonical Action form with that observation attached as direct evidence. You can also select several observations and create one Action from the list. A standalone Action with no evidence is allowed, but an observation-linked Action is easier to understand later.

What happens after review

• Marking reviewed does not delete or hide the observation.
• Creating an Action does not mark the observation reviewed automatically; both are separate decisions.
• Completing an Action does not automatically publish What changed.

Common scenarios

Safety issue. Set Critical or High, create an Action immediately, assign an owner and record the target date.

Process improvement. Create an Action with a realistic owner. If the work is not going ahead, record a Descoped Action with the reason rather than leaving it open forever.

Praise. Mark reviewed. There may be no Action, and that is a valid outcome.

Something outside the product's scope. Review it and use the appropriate internal process. CandorVoice is not a disciplinary or legal decision system.

Common mistakes

• Leaving every observation New.
• Marking an observation reviewed before anyone has read it.
• Creating an Action with no owner and no plan, then leaving it overdue.
• Treating Priority as a fact rather than a management decision.

What happens next

Reviewing changes only the review state. Creating an Action links the observation to work. A private follow-up opens a separate conversation. The observation remains in the list either way.

Troubleshooting

I cannot find the Action I created. Check the Action list's status tabs and whether it was created as a standalone Action. The observation detail should show its linked Actions.

The observation is reviewed but no work happened. Reviewed is bookkeeping, not a completion state. Create an Action if work is still needed.

A manager cannot change Priority. Priority is a management capability; a read-only viewer can see it but not change it.

Related features

• Feedback inbox
• Actions overview
• Actions completion and follow-up

What this does

Export CSV downloads the Feedback list you are currently looking at. When filters are active, the button reads Export filtered Feedback and the file carries the same filters.

How to use it

1. Set the period, status, Location, Category, Priority or search you need.
2. Choose Export CSV or Export filtered Feedback.
3. Open the downloaded file in a spreadsheet.

The export uses the same workspace, permission and Location scope as the screen. It cannot widen what you may see.

What the file contains

The CSV includes:

• feedback_reference (FB-N);
• submitted time;
• Location reference, code, name and Group;
• Category;
• review status;
• Priority;
• identity choice (Anonymous or Named);
• submitted name only when the observation is named;
• the observation text;
• reviewed time.

It deliberately omits internal IDs, the employee's email address, private follow-up conversation, abuse/security hashes and internal verifier values.

Anonymous rows

submitted_by is blank for an anonymous observation, and the identity column says Anonymous. There is no hidden identity to recover.

Spreadsheet safety

All cells are protected against spreadsheet formula injection, and the file carries a UTF-8 BOM so accented text opens correctly in Excel.

Common scenarios

A regional review pack. Filter to a Location Group, export, and share the file according to your internal data rules.

An investigation. Export only the filtered set you need. Do not export the whole estate because it is easier.

An employee asks what was recorded. The export shows the observation and the identity choice, not a hidden profile.

Important details

• The download is a working copy outside CandorVoice. Store and delete it according to your organization's policy.
• The export is audited with the row count and filters, never the observation text or a name.
• A manager's export is limited to the rows that manager can read.
• Large exports stream rather than loading the whole list into memory.

What happens next

The browser downloads the CSV. The export does not change the records. The audit trail records the row count and filters, not the observations.

Troubleshooting

The file has fewer rows than expected. The export matches the current filters and Location scope, not the whole workspace.

A name is missing. The observation is anonymous; there is no identity to export.

A CSV looks like a formula. Formula-leading cells are neutralised as text. The original observation remains intact in CandorVoice.

Related features

• Feedback inbox
• Privacy and security

What this does

These examples show how the same review workflow adapts to different kinds of observation. They are not scripts and do not replace your organization's policies.

A safety issue

“The loading bay door is not closing properly and people are holding it open with a crate.”

• Review immediately.
• Set Critical or High.
• Create an Action with an owner and a target date.
• If the risk is immediate, use your normal safety process alongside CandorVoice.
• Complete the Action with the outcome, then consider What changed.

A process improvement

“Shift handover takes too long because the checklist is on paper.”

• Review and decide whether the change is worth doing.
• Create an Action with a clear owner.
• If it is descoped, record the reason rather than leaving it open.

An equipment problem

“The freezer in the staff room has been broken for two weeks.”

• Review and create an Action if nobody is already handling it.
• Avoid saying in What changed that the freezer was replaced until it actually was.

Praise

“The new break room is much better.”

• Mark reviewed.
• No Action is required. Do not manufacture work.
• If the team wants to acknowledge it, do so through normal internal channels; CandorVoice is not a social feed.

A harassment concern

“A manager is speaking to one team member in a way that makes others uncomfortable.”

• Treat it as sensitive. CandorVoice records the observation but does not decide whether harassment occurred.
• Follow your safeguarding, HR and legal process.
• Do not publish identifying or investigative detail in What changed.
• Keep private follow-up private.

Anonymous Feedback

An anonymous observation has no stored identity. Act on the content. Do not attempt to infer the author from wording, timing or Location data, and do not ask other employees to identify them.

Feedback that needs an Action versus no Action

Create an Action when there is a decision, change or investigation to own. Do not create one when the observation is already handled, is praise, or is purely context. A reviewed observation with no Action is a complete outcome.

What CandorVoice does not infer

CandorVoice does not decide that a problem is solved, that a person is guilty, that harassment occurred, or that several submissions came from several employees. It stores the observation, the employee's chosen Category and the management review state. It can help organize work; a person makes the consequential decision.

Troubleshooting a repeated problem

If several observations describe the same underlying issue:

1. Read them together instead of treating each as a separate emergency.
2. Link the relevant observations to one Action where the work is genuinely the same.
3. Do not claim a number of affected employees unless you can prove it another way.
4. If the observations are spread across Locations, check whether a Group or regional manager should own the Action.

Common mistakes

• Treating one observation as proof of how many people feel the same.
• Promising a change before the work is approved.
• Publishing internal investigation detail to employees.
• Leaving a sensitive observation in a shared export or screenshot.

Related features

• Review and priority
• Actions overview
• Writing What changed updates

What this does

An Action records what management decided to do. It answers: what are we doing about this?

An Action can be linked to one observation, several observations, or nothing at all. A standalone Action is legitimate when management is already doing work and wants it visible.

The four statuses

Descoped is a decision, not a failure. It keeps the evidence and history, does not read as overdue, and cannot be shared as “We did”.

How to create an Action

From Feedback: open an observation and choose Create Action. The observation is attached automatically.

From several observations: select rows in Feedback and use the bulk Create Action.

From the Actions page: choose Create Action and write the work directly. Link evidence later if it helps.

What to include

• a clear title;
• a description of what the organization intends to do;
• a status;
• an optional owner;
• an optional target date;
• an optional priority.

The most useful title says what will change, not just “Fix issue”. For example: Replace the loading bay door hinge.

What happens after saving

• The Action appears in the Actions list.
• It can be assigned, edited and linked to evidence.
• If an owner is assigned, the Action appears in that person's Assigned to me tab.
• It does not publish anything to employees.

Common scenarios

One safety observation. Create an Action from the Feedback, assign the facilities lead and set a target date.

Several observations about the same handover problem. Select them and create one Action. The evidence shows that the work responds to several observations without claiming they came from different people.

A decision already made outside CandorVoice. Create a standalone Action so the work and outcome are visible. Add evidence later if a related observation arrives.

Important details

• Completing an Action requires an outcome.
• Completing an Action does not automatically create or publish What changed.
• The current customer product links Actions directly to Feedback. The retained internal Pattern capability is not part of the shipped customer workflow.
• An Action never changes or closes the evidence behind it.

Writing a useful Action

Useful: “Replace the loading bay door hinge so the door closes and latches.”

Useful: “Add a second handover checklist at the night desk and brief both shift leads.”

Poor: “Fix the door.” — no one knows what success looks like.

Poor: “Investigate issue.” — no decision, owner or outcome.

A useful title names the change. The description can hold the plan, constraints and owner context.

What happens next

The Action appears in the list, can be assigned and linked to evidence, and becomes visible in Assigned to me for its owner. It stays internal until a completed Action's outcome is deliberately published under What changed.

Troubleshooting

An owner cannot be assigned. They may not be able to see every Location the evidence touches. Narrow the evidence, change the owner, or adjust access deliberately.

An Action is overdue but nobody is working on it. Reassign it, change the target date to a realistic one, or descope it with a reason. Do not leave a misleading overdue label.

I completed the work and employees still do not know. Completion and employee communication are separate. Publish What changed.

Related features

• Ownership, target dates and alerts
• Completing an Action and follow-up
• What changed overview

What this does

An Action can have one optional owner and one optional target date. These are planning tools, not a second workflow.

Assigning an owner

Choose Assigned to and select an internal workspace member. CandorVoice only offers people who can see every Location the Action's evidence touches. If linking new evidence would take an existing owner outside their access, the link is refused.

Assignment means the person is responsible for the work, not that they can see more of the workspace.

Target dates

The target date is a date, not a status. The list derives labels such as:

• Due today
• Due tomorrow
• Overdue by 3 days
• Sep 25
• No target date

A completed or descoped Action does not show active overdue pressure.

Ownership alerts

The Notification Rules engine can send:

• Action assigned to me when the owner changes;
• Action due tomorrow;
• Action overdue.

Assignment notifications are addressed to the new owner. Due and overdue alerts are optional rules; they are not switched on by default. One target date produces at most one due-tomorrow and one overdue message per rule.

Common scenarios

A facilities issue. Assign the facilities manager and set a target date for the repair. The owner sees the Action in Assigned to me.

A regional manager cannot see the whole Action. The Action's evidence spans two Locations and the manager can see only one, so they cannot be assigned until their scope or the evidence changes.

The date is no longer realistic. Change the target date and record why in the Action activity. Do not leave an overdue label on a plan nobody intends to keep.

Important details

• Reassigning moves future due and overdue alerts to the new owner.
• Unassigning says nothing because there is no new owner to notify.
• A person can be assigned only work they can see.
• The Action owner is not necessarily the person who completes it, but both acts are recorded.

What happens next

Assignment immediately changes the owner and the Assigned to me tab. Due and overdue alerts follow the current owner and the current target date. A completed Action stops generating due/overdue pressure.

Troubleshooting

The desired owner is missing from the picker. They cannot see every Location in the Action's evidence. Change the evidence or the access deliberately.

The owner did not receive an assignment email. Check the workspace notification rule and the person's personal alert preference. Assignment is the default rule, but a deployment can change it.

Reassigning did not notify the old owner. The email is addressed to the new owner; the old owner is no longer responsible.

Related features

• Actions overview
• Settings: Notifications
• Roles and scope

What this does

Completing an Action records that the work is done and what actually changed. It also gives management an honest way to look at what arrived afterwards.

How to complete

1. Open the Action.
2. Choose Complete.
3. Write the Outcome. This is required.
4. Optionally choose Review again: no reminder, in 7/14/30 days, or a chosen date.
5. Save.

The Action records who completed it and when.

What happens after completion

• The Action status becomes Completed.
• It no longer reads as overdue.
• The outcome is visible to authorized management.
• Employees see nothing until management publishes What changed.
• The After this action section shows related observations before and after completion.

Post-action evidence

CandorVoice counts related observations that arrived strictly after completion. It reports counts and the latest date; it does not claim the Action worked. Absence of new Feedback does not prove success.

Follow-up

A completed Action can have one optional review date. When the date arrives, Home and the Action show a follow-up due state. Review it, add an optional internal note, and record that a person looked. You can schedule another review later, one date at a time.

Reopening and descoping

• Reopening returns the Action to normal target-date behaviour and clears the active completion record.
• Descoping requires a short reason and keeps the full history.
• A descoped Action cannot be published as “We did”.

Common scenarios

Repair completed. Write the outcome (“Hinge replaced; door closes and latches”). Review in 14 days to see whether related observations continue.

Work not going ahead. Descope with the reason, for example “Superseded by a new supplier contract”. Do not mark it Completed without an outcome.

Work completed but no Feedback arrived. That is a valid state. Record the outcome and do not claim that silence proves success.

Common mistake

Completing the Action and assuming employees now know. Publishing What changed is a separate step and requires employee-safe wording.

Scenario: Action completed, but no What changed published

Situation: the repair is finished, the outcome is recorded, and employees have heard nothing.

What to do in CandorVoice:

1. Open the completed Action.
2. Check the Employee update area.
3. If it says Not published, write You said and We did in employee language.
4. Review the audience and the employee preview.
5. Publish.

What happens next: employees at the frozen audience see the update under What changed after the Location gate. The internal Action remains the record of the work.

What happens next after completion

The Action stops reading as overdue. The post-action section shows related observations before and after completion. A follow-up review may be due later. Nothing is published automatically.

Troubleshooting

The completion form is missing an outcome. The outcome is required; describe what actually changed, not just “done”.

The Action shows no new related Feedback. That is a valid result. CandorVoice reports what arrived and does not claim the Action worked.

Review again is not offered. Follow-up applies to completed work, not planned, in-progress or descoped Actions.

Related features

• Actions overview
• What changed overview
• Follow-through

What this does

Follow-through is the operational view of the loop. It shows where work is waiting: unreviewed Feedback, open or overdue Actions, completed work without an employee update, and Locations that have gone quiet.

When to use it

Use it in a weekly management rhythm. It is faster than opening each area separately when the question is “where is the loop stuck?”

What to look for

• Unreviewed Feedback — nobody has read it yet.
• Open or overdue Actions — work is planned but not finished.
• Completed work waiting for What changed — management finished the work but employees have not been told.
• Quiet Locations — the channel may not be visible or the manager may not be active.
• Manager reminders — a request to an authenticated manager to keep the channel visible.

How to use it

1. Review the locations with the oldest or most urgent gaps.
2. Open the linked Feedback, Action or Location.
3. Fix the underlying gap rather than only clearing the indicator.
4. Use a manager reminder when the issue is attention, not data.

Important details

• Follow-through does not create a second workflow or a new status.
• A manager reminder is not an employee email and never identifies an anonymous submitter.
• A quiet Location is not automatically a problem; check whether it is seasonal, inactive or genuinely not using the channel.
• The page respects Location scope.

Scenarios

A Location has unreviewed Feedback. Open the observation, review it, and create an Action if work is needed.

A completed Action has no employee update. Open the Action's Employee update area and write the employee-facing wording if the change should be communicated.

A Location has not been reviewed for two weeks. Check whether the manager registered, whether the poster is visible, and whether a reminder or manager conversation would help.

What happens next

Fixing the underlying gap removes the item on the next pass. Clearing an indicator without fixing the work simply moves the problem to another report.

Related features

• Feedback inbox
• Actions completion
• Feedback reminders
• Reports overview

What this does

What changed is the employee-facing side of the loop. It lets management show employees that their Feedback led to something. It is not a news feed and not a second task system.

The two lines are always written by a person:

• You said — the issue or idea in plain employee language.
• We did — what actually changed.

CandorVoice never writes these lines and never copies an internal Action title or AI text into them.

How it relates to an Action

• A completed Action can be published as one employee update.
• One Action has one employee update.
• Completing the Action does not publish anything.
• Publishing is a separate decision on the completed Action.
• You can also create a manual update for a change CandorVoice did not track as an Action.

Who sees it

An update is visible only to employees at the Locations in its published audience, after the Location's normal PIN gate. The audience is frozen when the update is published. New evidence or newly linked Locations do not silently deliver an old update somewhere else.

What employees see

After the Location gate, the employee page has Share and What changed. The What changed half shows only:

• the two management lines;
• the publication date;
• the Location context.

Employees never see the internal Action title, description, outcome, evidence counts, names, review state or who published the update.

What management sees

The What changed list shows the reference (CHG-N), You said and We did, Locations reached, source Action or Manual, and publication date. You can Edit, Unpublish or Delete an update. The Activity list records what happened.

Common scenarios

A repair is finished. Publish: “You said: The staff room freezer is broken. We did: The freezer was replaced on Tuesday.” Only publish after the replacement is real.

A change was already made outside CandorVoice. Create a manual update with the relevant Locations. Link an Action if one exists.

A message needs correction. Edit the wording; employees see the correction immediately. The previous version stays in the restricted history.

An update should stop being visible. Unpublish it. The wording and audience are kept for a later republish.

Important details

• An out-of-service Location closes both Share and What changed until reactivated.
• A published update survives later changes to the Action's internal status.
• Do not include an allegation, investigation detail, employee name or unsupported claim.
• Updates are bounded in the employee view; employees see recent updates with a way to show more.

What happens next

• Publishing makes the two lines visible to employees at the frozen audience after the Location gate.
• Editing updates the visible wording immediately and keeps the previous version in restricted history.
• Unpublishing hides it from employees but keeps the wording and audience.
• Deleting removes it from the day-to-day list and keeps the audit history.
• A published update survives reopening, descoping or re-completing the Action.

Scenario: the problem was investigated but nothing changed

Situation: employees raised a concern, management investigated, and the decision was to keep the current process.

What to do in CandorVoice: do not publish a “We did” update that claims a change. Complete or descope the internal Action with the real decision. If it is appropriate to communicate, write an honest manual update that explains what was reviewed and what happens next, without naming anyone or exposing an investigation. If communicating would be harmful or premature, do not publish.

What happens next: employees do not see an unsupported claim. The internal record still shows that the concern was considered.

Troubleshooting

The Action is complete but the update is not visible. Check whether it is published, whether the employee is at a Location in the frozen audience, and whether the Location is active.

The update disappeared. It may have been unpublished or removed. Check the What changed list status filter and the Activity list.

The wording is wrong. Edit it; employees see the correction. Do not create a second update for the same Action.

Related features

• Writing useful updates
• Actions overview
• Privacy and anonymity

What this does

A good update closes the trust loop. It tells employees what was heard and what changed, without exposing internal work or overclaiming.

A simple structure

You said: the issue in words employees recognise.

We did: the concrete change, with a date or place if useful.

Good examples

You said: The staff room freezer is broken.

We did: We replaced the freezer in the staff room on Tuesday.

You said: Shift handover is confusing.

We did: We changed the shift handover checklist after employee Feedback.

You said: The night entrance is poorly lit.

We did: Two additional lights were installed at the night entrance this week.

Avoid

• “We improved communication.” — too vague to show what changed.
• “Employees are happier now.” — CandorVoice cannot prove that.
• “The issue is resolved.” — unless you can state the concrete change.
• Naming or describing an employee who raised a concern.
• Describing an investigation, allegation or disciplinary outcome.
• Promising a future change and presenting it as done.

What employees need

They need to recognise the issue and understand the change. They do not need the internal Action title, the number of submissions, the name of the owner, or a project reference.

Common scenarios

Small fix. State the physical change and the date.

Process change. Name the process and what is different now.

Change that is still in progress. Do not publish it as done. Wait until the work meets the definition of completed, or use an honest internal update instead.

Sensitive concern. Keep the public wording high-level and non-identifying. If the matter is under investigation, do not publish details; use whatever internal process applies.

Common mistakes

• Copying the Action description, which may contain internal names or operational detail.
• Publishing before the work is complete.
• Writing “you said” as a quote that the employee did not write.
• Using the update as a place to argue with the Feedback.

Scenario: a suggestion was implemented

Situation: an employee suggested a clearer handover checklist and the team implemented it.

Useful update: “You said: the handover checklist is hard to follow. We did: we replaced it with a short checklist and briefed both shift leads.”

What happens next: employees see the outcome under What changed. The internal Action records the work and its outcome.

Checking an update before publishing

Ask:

• Does “You said” sound like the issue employees raised?
• Does “We did” describe a real change?
• Is every claim supported by the work?
• Does it name or identify anybody?
• Is it free of investigation or disciplinary detail?

Related features

• What changed overview
• Actions completion

What this does

The primary poster workflow creates a print-ready poster for one Location. An employee scans it and lands on that Location's feedback page.

How to use it

1. Open QR & Posters.
2. Choose a Location. The selector is searchable and limited to Locations you may manage.
3. Check the real preview, the Location name and the Access state.
4. Choose Download poster for the default A4, portrait, PDF.
5. Or choose Download options for another size, orientation or format.
6. Optionally choose Edit text for this Location to change the words for this site only.

The shared design is changed from Change poster design, directly under the Location selector. A Location may have different words, but it never has its own template or colours.

What a Location poster contains

• the CandorVoice design and shared text;
• the Location's permanent QR code;
• the short feedback address;
• the current PIN when PIN protection is on;
• the generated access instruction for that Location.

What happens when you download

Downloading does not change the QR, PIN, scan history or Location. It produces a file from the current effective poster configuration.

Common scenarios

One small office. Choose the office, download A4 portrait PDF, print it, and put it in the staff room.

50 retail stores. Use the same shared design and text for every Location, then download posters per store. Use Download multiple posters for a batch.

Different wording for one site. Keep the shared design and main text, then Edit text for this Location for the lines that need local wording. Use Use main poster text to return to the shared text.

A poster is already printed. Do not rotate the QR. Changing the design, wording or PIN protection does not break the existing code. If the PIN changed, replace or annotate the printed PIN.

Important details

• The QR remains black on a white panel in every template.
• The QR encodes the permanent destination, not the PIN.
• The Location selector and poster list are server-side and paginated; a 1,000-Location workspace does not load every record.
• The Location's own page and QR centre show the same link, code and PIN.

What happens next

The downloaded file is ready to print or share. The QR still opens the same Location page; the PIN gate still applies if PIN protection is on. No scan, Feedback or Location setting changes merely because a poster was downloaded.

Troubleshooting

The poster asks for a PIN but I expected the form immediately. PIN protection is on for that Location. Turn it off only if your organization intends to remove that gate. The QR and link do not change.

The poster uses unexpected text. Check whether the Location has different text. Use main poster text restores the shared wording; changing shared poster text updates inherited Locations.

I changed the design and an old poster looks different. The old printed poster remains valid; only newly downloaded files show the new design.

The QR does not scan. Check print size and contrast, use the real preview, and avoid shrinking the code below the poster's safe area.

I changed the PIN. Existing QR and link still work, but printed material showing the old PIN needs replacing or annotating.

Related features

• Poster design and colours
• One poster for all Locations
• Download options and large batches

What this does

Change poster design controls the shared visual design and main text used by Location posters. It is a workspace-level setting.

What you can change

• Design — one of eight templates: Classic, Bold, Warm, Minimal, Dark, High visibility, Professional or Compact.
• Poster text — the shared headline, main prompt, privacy line and footer.
• Colours — background, text and accent.
• Preview — the all-Locations poster or one Location.
• Download preview.
• Use template colours.
• Reset to default, with confirmation.

How to change the design

1. Open QR & Posters.
2. Choose Change poster design.
3. Pick a template and check the preview.
4. Adjust the shared text if needed.
5. Optionally set safe hex colours.
6. Save changes.

The design applies to the all-Locations poster, every Location poster, multiple poster downloads, previews and PDF/SVG/PNG output.

Colour rules

There are exactly three colour controls:

• Background colour — the sheet behind the poster.
• Text colour — the headline and supporting words.
• Accent colour — rules and highlight elements.

The QR itself is never tinted. It stays black modules on a white panel with a quiet zone, whatever template or colour you choose.

The text colour is checked against the background at a 4.5:1 contrast target. A combination that is too hard to read is refused with a plain message. Use template colours clears explicit overrides. Changing template keeps any custom colours, so the page shows Custom colours to avoid a surprise.

Common scenarios

A warehouse needs a large, high-visibility poster. Choose High visibility and keep the default colours.

A care home wants a warmer look. Choose Warm and preview it before saving.

Brand colours clash with readability. Set a background and text colour that pass the contrast check, or use template colours.

One Location needs different words. Do not create a separate design. Use Location text overrides; the shared design stays consistent.

Common mistakes

• Expecting a Location to have its own template. It cannot.
• Choosing a very light text colour on a light background; it will be refused.
• Assuming the accent colour changes the QR. It does not.

What happens next

Saving the shared design updates the all-Locations poster and every Location poster that inherits the shared text and colours. A Location with its own wording keeps that wording but still follows the shared design.

Troubleshooting

A colour cannot be saved. The text/background contrast is too low. Choose a lighter or darker text colour, or use template colours.

One Location still shows old text. It may have an explicit override. Open that Location's poster text and use the main text if appropriate.

Changing the template kept my custom colours. That is intentional. The page shows Custom colours; use Use template colours to return to the template palette.

Related features

• Create a poster for a Location
• One poster for all Locations

What this does

The all-Locations poster is a secondary fallback. An employee scans one poster, enters the workspace all-Locations PIN, and chooses their Location.

It is useful when printing a separate poster for every Location is impractical, or when one noticeboard covers several sites.

How the employee uses it

1. Scan the all-Locations QR or open the short /u/{id} address.
2. Enter the all-Locations PIN.
3. Choose a Location.
4. Share Feedback. The chosen Location's PIN is not asked again in the same session.

How to open it

Open QR & Posters and find Need one poster for all Locations?. The panel is collapsed by default; choose View all-Locations poster.

You can:

• preview and download the poster;
• copy the link and PIN;
• change the shared design;
• open the Feedback page;
• use the rare Replace QR & PIN action.

When to use it

• a small office with one noticeboard;
• a shared staff area serving several Locations;
• a temporary event or multi-site building;
• a fallback when Location-specific printing is not possible.

When not to use it

Prefer the Location-specific poster when you want the employee to land directly on the right site. It is one less choice and one less step.

Important details

• The short address is stable and appears on newly printed all-Locations posters.
• Older all-Locations addresses continue to work; existing printed material is not broken.
• The all-Locations PIN is separate from a Location PIN.
• Editing or downloading never rotates the QR or PIN. Replace QR & PIN is the explicit rotation.

What happens next

The employee enters the all-Locations PIN once, chooses a Location, and submits Feedback. The chosen Location's own PIN is not asked again in that session. The submission still belongs to the chosen Location and follows its active/inactive state.

Troubleshooting

The employee is asked to choose a Location. That is the all-Locations flow. For a direct site, use that Location's poster.

The all-Locations PIN does not work. Check the PIN shown in the all-Locations panel, not the Location's PIN.

A Location is missing from the chooser. Check whether the Location is active and whether the poster is intended to cover it.

A printed all-Locations poster uses an older address. The older address remains valid; do not replace the poster only because a newer short address exists.

Related features

• Create a poster for a Location
• Employee feedback access

What this does

Poster downloads use the same effective words, design, QR and access state as the preview. You can download one poster, a different size, or a batch for several Locations.

Normal download

Download poster produces A4, portrait, PDF by default.

Download options

Download options opens a modal for the selected Location:

• Size — A0, A1, A2, A3, A4, A5, A6 or US Letter;
• Orientation — portrait or landscape;
• Format — PDF, SVG or PNG;
• a read-only summary of the effective text and access state;
• a real preview;
• Download poster or Cancel.

The size and orientation are remembered on the Location. The format is a download choice.

QR-only downloads

The QR can be downloaded on its own as PNG 512/1024/2048 or SVG. It still encodes the same permanent destination.

Multiple posters

Download multiple posters uses the same renderer. A Location with different words keeps its own words; every other page uses the shared text.

Small selections can be built immediately for the ZIP download. Larger selections become a queued poster pack, so a 1,000-Location request does not hold the browser open. The file is downloaded from the Locations or QR & Posters area when ready.

Common scenarios

A single office. A4 portrait PDF is enough.

A large noticeboard. A2 or A1 landscape may read better from a distance; preview it first.

A digital screen. Download PNG or SVG and use the file your screen system accepts.

1,000 Locations. Use the shared design and multiple-poster pack. The Location list remains paginated and searchable; it does not load the whole estate.

Important details

• A larger poster is not automatically more readable; check the QR size in the preview.
• Different words do not change the design or QR.
• Downloading a pack does not rotate any QR or PIN.
• Keep the printed material current if the PIN changes.

What happens next

A small selection downloads immediately as a ZIP. A large selection becomes a queued pack; the page shows when the file is ready. The pack uses the same effective text, design and QR as a single download.

Troubleshooting

The multiple download is not ready. A large pack is queued. Check the poster pack status from the Locations or QR & Posters area; do not resubmit the same large selection repeatedly.

One poster in the pack has different text. That is intentional: the Location has an explicit override. Review it or use the main text.

The file is too large to print. Choose a smaller paper size or a single Location from Download options.

Related features

• Create a poster for a Location
• Poster design and colours
• Enterprise scale

What this does

A Feedback reminder group holds the people who should be nudged for one Location and one recurring reminder. The email carries the Location's shared QR, link and current PIN, so recipients can pass the channel on.

How to create one

1. Open Feedback reminders.
2. Create a group and choose its Location.
3. Add recipients individually or import a CSV.
4. Configure the reminder: frequency, send time, subject and message.
5. Turn the reminder on when it is ready.

Creating a group does not send anything. Enabling a reminder schedules the first occurrence one full cadence away.

Schedule

Choose 7, 14 or 30 days, or a custom interval from 7 to 90 days, and a send time. The time uses the Location's timezone. The next occurrence is based on the previous one, not on the time the scheduler happened to run.

Recipients

A recipient has an optional name and a required email address. Adding one creates no CandorVoice account, password, invitation or membership. The same address can appear in different groups but not twice in one group.

A recipient can be marked suppressed without being removed. Suppressed recipients stay visible to management but receive no future reminders. Every reminder email includes a signed unsubscribe link that suppresses that one recipient.

Sending

• Preview shows the real email.
• Send test sends one labelled copy to the signed-in manager only.
• Send now queues one message per active recipient after confirmation and does not move the next scheduled reminder.
• Pausing stops future sends and keeps everything; resuming starts a fresh cadence.

Delivery history

Each send is recorded as Scheduled, Manual or Test with eligible, queued, sent and failed counts. A failure names the address and a safe category. There is no opened, clicked or delivered state.

Common scenarios

A staff room reminder every 14 days. Create one group, add the site leads, and send at a time the team is likely to see it.

A recipient unsubscribes. They remain in the group as suppressed. Management can reactivate them later.

A Location is inactive. The reminder is not sent. The group and configuration stay; reactivating the Location resumes future sends.

Important details

• Every recipient gets the same shared QR, link and PIN. There is no recipient-specific feedback link.
• CandorVoice cannot attribute an anonymous submission to a reminder recipient.
• A recipient is an operational email address, not an employee record.
• There is no SMS, Slack, Teams, bounce processing or reminder analytics.

What happens next

Enabling the reminder schedules the next occurrence. At that time, CandorVoice queues one message per active recipient. The delivery history records the result per group, and the next occurrence is calculated from the cadence rather than from the time the scheduler ran.

Troubleshooting

No reminder arrived. Check whether the group is active, the reminder is enabled, the Location is active, and the recipient is not suppressed. Then check the delivery history for a failed address.

Send test did not reach the group. It is designed to reach only the signed-in manager.

Send now did not change the schedule. That is intentional; Send now is one manual send.

The same address is refused. It is already in that group. An address can appear in different groups.

A recipient wants to stop. They can use the unsubscribe link, or management can suppress them.

Related features

• Team reminders
• Reminder privacy
• Feedback reminders overview

What this does

A Team reminder asks existing workspace users to encourage their own team to share Feedback. It is useful when the organization does not want to put employee email addresses into CandorVoice.

How it differs from a Feedback reminder group

• Recipients are existing workspace users, not outside email addresses.
• The email goes to the manager, not directly to employees.
• It carries the Location QR, link and PIN plus a copy-ready message the manager can forward.
• There is no employee recipient list.

How to set it up

1. Open the Location's reminder area.
2. Choose the existing users who should receive the reminder. Only people who can see the Location are offered.
3. Choose the frequency, time and optional short message.
4. Enable it.

What happens before each send

Access is re-checked. A person removed from the workspace or from the Location scope receives nothing. The history says how many selected people can still receive it.

Sending and pausing

Send test reaches only the manager who asked and is labelled as a test. Send now queues eligible managers after confirmation. Neither moves the next scheduled reminder. Pausing keeps the configuration and does not release a backlog later.

Important details

• The email contains no employee identity, feedback text or private conversation.
• The manager forwards the shared channel; CandorVoice does not learn who the manager forwarded it to.
• An inactive Location pauses sending but does not delete the reminder.
• Team reminders use the same honest delivery states as Feedback reminders.

What happens next

Enabling schedules the next future occurrence. At send time, CandorVoice re-checks each selected manager's current access. Eligible managers receive the shared channel details; the history records who was eligible, queued or failed.

Troubleshooting

A manager receives nothing. Check their workspace membership, Location scope and the delivery history.

Send now says fewer people will receive it. Some selected people can no longer see the Location or are no longer members.

The Location is inactive. The reminder pauses. It does not send late when the Location is reactivated.

Related features

• Reminder groups and schedules
• Reminder privacy

What this does

Reminders are operational messages, not employee tracking. They keep a shared channel visible without creating a link between a recipient and a submission.

What every reminder contains

• the Location name;
• the same shared QR code every employee sees;
• the same shared feedback link;
• the current PIN while PIN protection is on;
• the manager's subject and message;
• the CandorVoice brand and footer;
• a signed unsubscribe link for that recipient, when it is a Feedback reminder group.

What it never contains

• a recipient-specific QR or feedback URL;
• an employee identity;
• another workspace's data;
• a hidden tracking pixel;
• an opened/clicked record.

Delivery states

CandorVoice records eligible, queued, sent and failed counts. Sent means the transport accepted the message. It does not mean the recipient opened or read it. A failure is recorded per address with a safe category.

Unsubscribe

The unsubscribe link suppresses that one recipient and shows a page that names nothing. Management can put the recipient back on the list. There is no public resubscribe flow.

Common scenarios

One recipient's mailbox is full. The other recipients still receive their reminders; each message is its own job. The history shows the failed address and category.

A manager leaves the workspace. A Team reminder re-checks access and does not send to them.

An employee unsubscribes. They are suppressed, not deleted. Management can see the state.

Important details

• CandorVoice does not claim a reminder caused a Feedback submission.
• Anonymous submissions stay anonymous even when a reminder was sent to a manager.
• Do not put sensitive employee information in a reminder message; it is an operational email.

What happens next

The recipient either receives the shared channel details or is suppressed. Management can see the per-address delivery result. A reminder never creates an attribution between a recipient and a submission.

Troubleshooting

A recipient still receives mail after unsubscribing. Check that the unsubscribe link was for that address and that the recipient is actually suppressed. A new address is a different recipient.

A recipient's name appears nowhere. Reminder delivery is about addresses; the message does not need employee identity.

The history says sent but the person did not see it. Sent means the transport accepted the message; CandorVoice does not claim delivery, opening or reading.

Related features

• Reminder groups and schedules
• Team reminders
• Privacy and anonymity

What this does

A Poll is one question management asks the people at chosen Locations. It is deliberately not a survey builder: one question, a small set of answer shapes, a frozen audience and a plain result.

The lifecycle

How to create a Poll

1. Open Polls and choose Create.
2. Write the question.
3. Choose the answer type: Yes/No, single choice, scale or open text as offered by the current product.
4. Add the answer options where needed.
5. Choose the Locations.
6. Optionally link a completed or in-progress Action.
7. Choose how long it runs.
8. Choose Save draft.

Nothing reaches an employee until somebody chooses Publish poll.

What employees see

The employee Location page has Share, Polls and What changed. The Poll reuses the Location's short address and PIN. There is no Poll-specific PIN or account.

The employee sees the question and answers only. After answering, the Poll reads Answered. A locked or inactive Location cannot answer.

Common scenarios

Which option is causing the problem? Ask a single-choice question after reading several related observations.

Validate a proposed improvement. Ask whether a change would help before committing to the full Action.

Quick operational check. Ask a Yes/No question after a process change.

Important details

• Publishing freezes the audience. A Location added later is not silently included.
• A published Poll cannot be edited; changing the meaning after answers exist would rewrite what those answers meant.
• One ballot credential counts one answer; CandorVoice does not fingerprint people.
• Management scope fails closed: a Poll is visible only when the viewer can manage every Location in its audience.

What happens next

Publishing makes the Poll available on the chosen Locations' employee pages. Answers are accepted until the Poll closes. Closing stops new answers and keeps the results. A draft can still be edited; a published Poll cannot.

Troubleshooting

Employees do not see the Poll. Check the Poll status, the frozen Location audience, and whether each Location is active. A Location's own PIN still applies.

A published Poll needs a different question. Create a new Poll. Editing the published wording would change what earlier answers meant.

The per-Location result is hidden. The Location has fewer than the privacy threshold. Show the overall count or wait for more answers.

Management cannot see the Poll. The viewer must be able to manage every Location in its audience.

Related features

• Poll results and privacy
• Actions overview
• Employee feedback access

What this does

A Poll result is an aggregate view of the answers management received. It is not an employee-level record and not an engagement score.

Structured answers

The Poll shows counts and shares for the answer options. Overall totals are visible. Per-Location breakdowns are hidden until that Location has at least three responses by default; until then the count is shown and the breakdown is replaced by a privacy message.

Open text

Open-text answers are shown anonymously and paginated. CandorVoice does not attach an identity, response reference or timestamp to the displayed answer. Open text is not turned into Feedback and is not sent to AI.

One ballot credential

Opening a Poll issues a browser a Poll-specific secret. The server stores only a keyed verifier. One credential counts one answer; a replay is refused. CandorVoice does not store an IP address, device fingerprint or employee identity with the answer.

What you can say

• “Most respondents chose option B.”
• “The per-Location result is hidden until three answers.”
• “The Poll closed on Tuesday.”

What you cannot say

• “Ten employees voted.” The product counts ballots, not verified people.
• “The team is engaged.” A Poll does not measure engagement.
• “This proves the change worked.” A Poll records answers; it does not prove causation.

Polls and Actions

A completed or in-progress Action can offer a Create follow-up Poll shortcut with the Action and evidence Locations prefilled. It opens the normal Poll form and creates nothing until you save and publish. The shortcut is available only when you can manage every Location the Action touched.

Common scenarios

A small Location has two answers. The overall count is visible, but the per-Location breakdown is hidden until the threshold is reached.

An open-text answer names a person. Do not publish or forward it as an employee record. Treat it as sensitive content and follow your normal policy.

A Poll is no longer useful. Close it. Results remain.

What happens next when a Poll closes

No new answers are accepted. The existing answers remain available under the Poll's results and privacy rules. Closing does not create an Action or publish What changed.

Troubleshooting

An answer was submitted twice. The ballot credential is designed to count one answer; a replay is refused. Use another browser and the product cannot tell it is the same person, which is the anonymity trade-off.

The open-text answer looks identifying. Do not copy it into a public update. Treat it as sensitive and follow your privacy policy.

The Poll is linked to an Action but the audience differs. The Action shortcut prefills evidence Locations, but the Poll's audience is frozen when published. Verify it before publishing.

Related features

• Polls overview
• Privacy and anonymity

What this does

A report answers: what happened, where, and what needs attention? It is a definition with one owner, a scope, a period, a schedule and a set of recipients.

How to create one

1. Open Reports.
2. Choose Create report.
3. Name it and choose the sections.
4. Choose the Locations, Group or all Locations you can access.
5. Choose the period: last 1, 7 or 31 days, or 3, 6 or 12 months.
6. Choose daily, weekly or monthly timing.
7. Choose recipients from workspace users and verified external addresses.
8. Save active or save paused.

Preview, test and generate

• Preview shows the real email for the current period without sending.
• Send test produces a TEST-labelled copy for the manager who asked.
• Generate now creates a snapshot for the period ending now and sends it.

None of these moves the next scheduled run.

What a report contains

The available sections include Overview, Feedback, Categories, Priority, concentration, Action coverage and speed, Actions, QR activity, Location health, post-Action follow-through and Polls. The exact list is shown on the form.

Snapshots

A generated report is frozen. The numbers, period, scope and Location names are captured when it runs. A later change cannot rewrite what a recipient already received.

Common scenarios

A weekly operations brief. Last 7 days, all accessible Locations, every Monday at 08:00, sent to the operations leads.

A monthly regional report. One Group, last 31 days, monthly on the 1st, sent to the regional manager and the workspace owner.

A personal check. Create a paused report, preview it, and switch it on only when the content is right.

Scenario: a weekly operations meeting

Situation: the operations leads meet every Monday and want the same brief.

What to do: create a weekly report, last 7 days, all accessible Locations, Monday 08:00, with the sections the meeting actually reads. Send a test first, then switch it on.

What happens next: the report runs on its own clock and the snapshot is frozen. The meeting reads the same numbers the recipients received, even if new Feedback arrives during the meeting.

Scenario: a regional manager report

Situation: a regional manager should see one Group, not the whole estate.

What to do: choose that Group as the scope and the regional manager as a recipient. The manager must be able to read every Location in the Group.

What happens next: the next run re-checks the Group and the manager's access. A Location moved out of the Group leaves the report; if the manager loses access, they stop receiving it.

Scenario: an executive overview

Situation: an executive wants the period's shape, not every operational row.

What to do: use a longer period, the summary and attention-oriented sections, and a small recipient list.

What happens next: the report stays a frozen snapshot of counts and dates, not a live dashboard and not an ROI or engagement verdict.

Important details

• A report never contains raw employee Feedback, an employee identity, a PIN or a QR token.
• The scope is re-checked when the report runs.
• A recipient must be able to read every Location in the report.
• There is no public report link.

What happens next

Saving an active report schedules it. At the due time, CandorVoice generates a snapshot and queues delivery to the eligible recipients. Pausing stops future runs; existing generated reports remain. Duplicating a report creates a paused copy owned by the person who duplicated it.

Troubleshooting

A Location is missing from the report. Check whether it is in the report's scope. The report scope is not a live "all Locations" unless that is what the definition says.

A report recipient cannot open the full report. Their current access no longer covers every Location in the snapshot.

The report says fewer Locations participated than expected. Participation counts in-service Locations with at least one observation in the period, not every Location with a poster.

The report has no previous-period comparison. The frozen history may be incomplete. The report labels partial history rather than inventing a comparison.

Related features

• Report metrics
• Report delivery
• Settings: Notifications

What this does

Reports use counts, dates, shares and comparisons drawn from the same data as the management screens. They are deterministic.

The main figures

Comparisons

A report may state an absolute change or a percentage against the previous equal period. It does not state a percentage against a zero baseline. A partial history is labelled as partial rather than presented as a clean comparison.

What is not a metric

CandorVoice does not use:

• an engagement score;
• a culture score;
• an ROI score;
• a “health” score for a Location;
• a claim that an Action was effective;
• a claim that a scan is a person;
• a claim that submissions equal distinct employees.

Common scenarios

Twice as many observations as last week. State the counts and the comparison. Do not call it an engagement increase.

No observations this period. Report the zero and the work still open from earlier. Do not describe silence as success.

One Location carries most of the volume. State the share and note that volume is not performance. A larger site may naturally submit more.

What happens next

Use the metric to choose a question or an area to open, not as a verdict. Clicking through to Feedback, Actions or Locations shows the records behind the number. The report snapshot stays frozen even if those records change later.

Troubleshooting

The report total differs from Home. They may use different periods or scopes; Home is current and a report is frozen.

A percentage comparison is missing. The previous equal period may have no baseline or incomplete history.

The Location table omits a site. Check the report's scope. A single-Location report may omit the table entirely.

A number looks like a score. It is a count, date or share. There is no engagement, culture or ROI score.

Related features

• Reports overview
• Home and attention

What this does

A report is sent to the people it is addressed to. Recipients are chosen from workspace users and the workspace's verified external addresses, never typed freely.

To, Cc and Bcc

• At least one person must be in To.
• A name can appear in only one role.
• Every recipient must be able to read every Location in the report.
• External recipients receive the report email; they do not get a CandorVoice account.
• CandorVoice delivers one message per destination, so a Bcc address is not revealed to the others.

What recipients receive

The email opens with the period and scope, then a short factual summary and the configured sections. A CandorVoice recipient can open the authenticated full report; an external recipient receives the summary.

Delivery history

The generated report records when it ran, whether it was Scheduled, Manual or Test, and how many deliveries succeeded or failed. There is no delivered, opened or read state.

Common scenarios

A report recipient leaves the workspace. The next run re-checks access and does not send to them. The history records the failure.

A report covers Locations the recipient cannot see. They cannot be chosen. If their access narrows later, they stop receiving the report.

One email address fails. The other recipients still receive their copies. The history shows the failed destination.

What happens next

The generated report remains in the history with its delivery counts. A failed recipient does not stop the others. If the recipient's access changes later, the next run re-checks it; the already-generated snapshot does not rewrite itself.

Troubleshooting

A recipient was not sent the report. Check their current access to every Location, whether they left the workspace, and the delivery history's failure category.

An external recipient cannot open the full report. External recipients receive the summary and no authenticated full-report link.

A Bcc recipient is not named in the history. Delivery is one message per destination; the report counts the Bcc without revealing the address to other recipients.

Important details

• There is no public report link.
• A report is frozen at generation; later data does not rewrite it.
• The email is management-safe: no raw employee Feedback or private conversation.

Related features

• Reports overview
• Team and invitations
• Settings: Notifications

What this does

Ask CandorVoice lets a manager ask a plain-language question and receive a short answer grounded in the CandorVoice records that manager may see. It is a read-only assistant, not a chatbot that changes the workspace.

What it can answer

• What changed this week?
• Which Locations need attention?
• What are employees mentioning most?
• Which Actions are overdue?
• What improved this month?
• What evidence supports this observation?

It can also answer narrower questions about Feedback, Actions, Polls and What changed within the current scope.

Evidence and sources

CandorVoice retrieves a bounded evidence set from its own records, gives the provider only that evidence, and validates the answer's citations. Source links point back to authorized CandorVoice records. If the evidence is insufficient, the answer says so rather than guessing.

Location scope

The question uses the same Location scope as the rest of the product. A regional manager sees their Locations; a Location manager sees their sites. A question naming a Location outside scope is refused without confirming whether it exists.

Read-only

Ask CandorVoice cannot create or close Feedback, create or complete Actions, invite users, edit Locations, change Polls or reports, alter settings, send email or delete records. A request to change data receives a plain read-only response.

What it will not do

• It does not browse the web.
• It does not run SQL or Laravel tools.
• It does not reveal prompts, keys or internal infrastructure.
• It does not identify or deanonymize employees.
• It does not treat correlation as causation.

Common scenario

A regional manager asks: Which Locations need attention this month? The answer names the Locations in their scope, cites the underlying observations or Action state, and does not mention a Location they cannot see.

What happens next

An answered question shows a short answer with source links. Opening a source takes you to the authorized record. A failed question shows a safe reason and changes nothing. Every new question re-checks access.

Troubleshooting

The assistant is not available. A workspace administrator must connect and test a provider, choose it for Ask CandorVoice, and enable the feature.

Another manager gets a different answer. Their Location scope differs. That is expected.

The answer has no useful detail. The evidence may be insufficient or the question too broad. Narrow the topic, period or Location.

Related features

• Connecting an AI provider
• Example questions
• Limits and failure behaviour

What this does

Ask CandorVoice uses the workspace's own AI provider connection. CandorVoice does not supply a platform key for this feature.

Supported providers

• OpenAI
• Claude (Anthropic)
• Gemini (Google)
• DeepSeek

How to connect

1. Open Settings → Ask CandorVoice AI.
2. Choose a provider card.
3. Paste that provider's API key and, if needed, set the model under Advanced.
4. Save.
5. Choose Test connection. The test sends a minimal synthetic structured request, not workspace data.
6. When the test passes, choose Use for Ask CandorVoice and enable the feature.

What is stored

The key is encrypted at rest. CandorVoice keeps only the last four characters for display and never shows the full key again. Each provider connection has its own key, model and test state.

One active provider

A workspace may keep several tested connections, but exactly one is active. Disconnecting the active provider disables Ask CandorVoice; it does not silently promote another provider. You choose the next provider explicitly.

No automatic failover

There is no fallback to a platform key, another workspace's key, another saved provider or an environment variable. If the active provider fails, the request fails with the provider named.

Common scenarios

A security team wants one approved vendor. Connect only that provider and leave the others empty.

A key is rotated. Replace the key, test the connection again, and re-enable if necessary.

A provider has an outage. Ask CandorVoice reports the failure. It does not quietly switch providers.

Important details

• Normal users do not see provider or model configuration on the Ask page.
• The connection test proves the credential and structured-output capability, not the quality of a future answer.
• The workspace pays its own provider according to that provider's terms.

What happens next

A tested connection can be selected for Ask CandorVoice. The feature remains disabled until it is enabled. Replacing a key or model requires a fresh test; the previous test result is not reused.

Troubleshooting

The key saves but the feature stays disabled. Test the connection and choose Use for Ask CandorVoice.

The test fails. Check the key, model, provider account and network access. The error should name a safe category, not the key.

Another saved provider does not take over. Automatic failover is deliberately absent. Choose the next provider explicitly.

Related features

• Settings: Ask CandorVoice AI
• Ask CandorVoice overview

What this does

Ask CandorVoice works best with a clear management question about the current records, not a request to speculate.

Good questions

• What changed this week?
• Which Locations need attention?
• What are employees mentioning most?
• Which Actions are overdue?
• What improved this month?
• Which Feedback supports the change we shared?
• What did employees at this Location mention last month?

Questions that need a narrower scope

If a question covers the whole workspace but you can see only some Locations, CandorVoice answers for your scope. Name a Location or Group when you want a narrower answer.

Reading the answer

The answer should:

• state what the records show;
• cite the CandorVoice records behind it;
• distinguish counts from interpretation;
• say when evidence is incomplete.

The answer should not:

• claim how many distinct employees spoke;
• identify an anonymous submitter;
• present a correlation as proof;
• invent a Location, date, count or Action.

When evidence is insufficient

Ask CandorVoice says so. It does not fill the gap with general knowledge. Rephrase the question, narrow the period, or inspect the underlying Feedback directly.

Common scenarios

“What improved this month?” The answer looks for completed Actions, published What changed updates and related observations. It does not claim the Action caused the improvement.

“Which Locations need attention?” The answer uses urgent observations, overdue Actions and operational signals. It respects Location scope.

“Who wrote this anonymous Feedback?” It refuses and redirects to workplace patterns. CandorVoice has no identity to reveal.

What happens next

The answer is bound to the evidence retrieved for that question. If the evidence does not support a claim, the answer is rejected or says it cannot answer. A source link opens the record only if the viewer still has access.

Troubleshooting

The answer names an unexpected Location. Check the scope of the question and the Locations you can access.

A source link is missing. The answer may not have been grounded, or the record may no longer be available to you.

The answer says the evidence is insufficient. Try a narrower period or Location, or read the underlying Feedback directly.

Related features

• Ask CandorVoice overview
• Limits and failure behaviour

What this does

Ask CandorVoice is an additional management surface, not a dependency for basic CandorVoice work. Feedback, Actions, Polls, What changed and reports continue to work without it.

When it is unavailable

It can be unavailable because:

• no provider is connected;
• the active connection has not passed its test;
• the provider is rate-limiting or down;
• the answer cannot be grounded in the retrieved evidence.

CandorVoice shows a safe message and does not switch providers or invent an answer.

What is not sent

The provider request excludes API keys, employee PINs, QR tokens, passwords, session or invitation tokens, IP addresses, device fingerprints, billing data, audit internals and infrastructure credentials. Anonymous Feedback has no identity to send.

Failure bounds

A bounded retry may be used for connection failures, timeouts, rate limits and server errors. Authentication and invalid-request failures are not retried. Malformed structured output may get one repair attempt.

Common scenarios

A provider key expires. Ask CandorVoice fails with the provider named. A workspace administrator replaces the key and tests it.

A question is too broad. The answer may say the evidence is insufficient. Narrow the period, Location or topic.

A provider returns an invented record. CandorVoice rejects the answer rather than showing a citation that was not in the evidence set.

Troubleshooting

“No active AI provider.” A workspace administrator must connect a provider, test it and choose Use for Ask CandorVoice. Connecting a key alone does not enable the feature.

“Question cannot be answered from available evidence.” Narrow the question or period, or inspect the underlying records. Ask CandorVoice will not fill the gap with general knowledge.

“Customer data storage unavailable.” The workspace's content plane cannot be read. Check Data storage health and fail-closed state. Ask CandorVoice does not read retained central copies as a fallback.

The answer is different for another manager. That is expected when their Location scope differs. The answer is limited to what each manager may see.

The provider is rate-limited or down. The request fails with the selected provider named; no other provider is called.

What happens next

An answered question shows the answer and its sources. A failed question shows a safe reason and does not mutate any record. Each request re-checks the current membership and scope, so a later question uses the access in force at that time.

Important details

• Ask CandorVoice is read-only.
• It does not run SQL, browse the web or call arbitrary tools.
• It records usage metadata, not the question/answer content, in the usage ledger.
• Every answer re-checks the current membership and Location scope.

Related features

• Ask CandorVoice overview
• Connecting an AI provider
• Privacy and AI processing

What this does

Spam keeps Feedback that a manager marked as spam or that matched the Location's abuse rules separate from the normal inbox. It prevents abusive or irrelevant submissions from dominating normal review and reporting.

What appears here

• a submission a manager explicitly marked as spam;
• a submission that matched the deployment's abuse rule.

The original observation is kept. Spam is a classification, not a deletion.

How to review

1. Open Spam.
2. Read the observation and its source.
3. If it is genuinely spam, leave it there.
4. If it was classified incorrectly, choose Not spam. It returns to Feedback and stops the matching rule for that item.

What happens after restoring

The observation appears again in the normal Feedback list and counts toward normal review and reporting. The action is recorded where the product records management changes.

What spam affects

Spam submissions are excluded from the normal Feedback inbox and the normal reporting totals. The Spam area keeps them visible to authorized managers.

Common scenarios

An abusive submission. Leave it in Spam. Do not engage with the sender.

A legitimate complaint was caught by a rule. Open it and choose Not spam. Review the rule if this happens repeatedly.

A manager disagrees with a classification. Only people with access to the Spam area should change it; the original observation remains available.

Important details

• CandorVoice does not notify the sender that a submission was classified as spam.
• Spam classification is not a judgment about the person.
• Do not use Spam to hide criticism or a safety concern. If it is a real observation, restore it.
• The abuse rules are deployment-controlled; the Spam screen does not expose security internals.

What happens next

Not spam restores the observation to the normal Feedback list and normal reporting. Leaving it in Spam keeps it out of normal totals while preserving it for authorized review.

Troubleshooting

A real concern was marked as spam. Restore it with Not spam, then review it promptly. Check whether the abuse rule is too aggressive.

A sender keeps submitting abuse. Leave the item in Spam and follow your organization's abuse process. CandorVoice does not notify the sender.

Spam counts differ from Feedback counts. They are separate views; spam is excluded from normal totals.

Related features

• Feedback inbox
• Privacy and security

What this does

Users lists people who have joined the workspace. A pending invitation is not a user.

What you can see

• name and email;
• workspace role;
• join/access state;
• the Locations or Groups the person can see, where shown.

Common actions

• search and filter by role;
• open a person's access where the product allows;
• change a role or scope through the workspace's team controls.

Common scenarios

A manager accepted an invitation. They appear under Users and can sign in.

A manager has not accepted. They appear under Invitations, not Users.

A person left. Removing their workspace access does not erase the historical record of what they did.

Important details

• A Location Manager role is intentionally narrower than a workspace administrator.
• A person can belong to several Locations; a Location can have several managers.
• User access is workspace-scoped.

What happens next

Changing a person's role or Location scope applies on their next request. Removing their workspace access does not erase the historical record of their work.

Troubleshooting

A person is missing from Users. They may still be under Invitations; a pending invitation is not a user.

A person can see fewer Locations than expected. Check their explicit Location list or Group access, and whether a Location moved out of a Group.

A former member still appears in history. Removing access does not rewrite past Actions, audit events or Feedback metadata.

Related features

• Invitations
• Invitation lifecycle
• Roles and scope

What this does

An invitation offers a person access to the workspace with a chosen role and Location scope. It is not a user account until it is accepted.

How to invite

1. Open Team → Invitations.
2. Choose Invite user.
3. Enter the email.
4. Choose the role.
5. Choose all Locations, selected Locations, or Groups.
6. Send.

You can also invite several people from a CSV. The same grant policy applies to the manual form, the CSV and the bulk setup.

What the person receives

An email with an invitation link. The link contains the invitation destination and is time-limited. It does not contain an employee Feedback message or a reusable workspace secret.

Common scenarios

A new store manager. Invite them with the Location Manager role and that store.

A regional manager. Give them a Group so future Locations in the Group are covered.

A colleague who already has access. Do not invite them again; update their existing membership scope instead.

Important details

• The inviter can grant only Locations and Groups inside their own scope.
• A person's access is not widened by accepting an invitation beyond what the invitation names.
• The invitation remains visible in the ledger after acceptance as Registered.
• Several Locations for one person should be one invitation with several scopes, not several invitations.

What happens next

The invitation is queued for email delivery and appears in the ledger as Invited or Send failed. Acceptance creates the user and the chosen scope; the ledger keeps the invitation as Registered history.

Troubleshooting

The invite button is unavailable. Check your role and whether you can grant the selected Locations or Groups.

The address already has access. Update the existing membership instead of inviting again.

The invitation was sent to the wrong scope. Revoke it and create a new invitation; do not rely on the person accepting a broader offer than intended.

Related features

• Invitation lifecycle
• Team and invitations overview
• Bulk Operations overview

What this does

The Invitations list is a ledger of every invitation the workspace has sent. It answers: what happened to this offer?

Resending

Resend keeps the same invitation, token, role and scope. It does not create a second membership. The server enforces a cooldown (default ten minutes) so a double click cannot send repeatedly.

Bulk resend

Selected invitations can be resent. Small selections run in the request; larger selections are queued in bounded chunks. Every retry re-checks the cooldown.

Common scenarios

The email never arrived. Check Send failed first. If it says Invited, ask the person to check spam, then resend after the cooldown.

The invitation expired. Create a fresh invitation. An expired token cannot be revived by resending.

The person says they registered. Check the state. Registered is history and should not be resent.

A manager was invited to the wrong scope. Revoke and create a new invitation with the correct scope; do not try to widen the old offer silently.

What happens next

A send moves the invitation to Invited (or Send failed). Acceptance creates the user and the invitation becomes Registered history. A resend keeps the same token, role and scope. A revoke kills the token but keeps the row.

Troubleshooting

Resend is not available. The invitation may be registered, revoked, inside the cooldown, or the action may be hidden for your role. The server enforces the same rule.

The person says the link expired. Create a new invitation; resending an expired token does not revive it.

The person accepted but does not appear in Users. Check the state and refresh; acceptance creates the membership through the canonical invitation path.

An invitation names a Location the inviter cannot grant. The file or form should have refused it. Check the uploader's own scope and the Location or Group reference.

The same person needs more Locations. Add the new scope to a compatible pending invitation or update the registered membership; do not create a duplicate account.

Important details

• A pending invitation is not a user and does not grant access.
• Resending does not change the role or scope.
• The ledger is workspace-scoped; one workspace cannot see another's invitations.
• Do not forward an invitation link to somebody else; it is addressed to one email.

Related features

• Invitations
• Users
• Bulk Operations overview

What this does

Bulk Operations is the file-based route for setting up many Locations and people. It keeps the same business rules as doing the work one at a time.

The three steps

1. Set up Locations & Managers — create Locations and prepare manager invitations from one file.
2. Invite Users — invite managers and team members with the Locations or Groups they may see.
3. Print QR & Posters — produce the employee posters for the new sites.

Each step is authorized on its own. A manager may see only the steps they are allowed to perform.

When to use it

• opening many stores or sites;
• moving an existing estate into CandorVoice;
• giving many people access;
• preparing a large poster run.

How the workflow feels

Nothing changes when you upload. You review what CandorVoice understood, resolve or accept row issues, and confirm. The confirm button names what will happen. Large work is queued and the operation row keeps the status.

Common scenarios

1,000 new Locations. Start with a two-column file (location_name,email) and use the flagship setup. CandorVoice creates Locations and prepares one invitation per manager.

Existing Locations, new managers. Use the users/access file with LOC-N references.

A poster run only. Skip the imports and go to QR & Posters; use the multiple-poster download for the chosen Locations.

Important details

• A blank cell does not erase existing data.
• A Location not in the file is not deleted, deactivated or taken away from anybody.
• The file does not grant access beyond the uploader's own scope.
• Preview and confirm are explicit; a wrong file can be corrected before anything changes.

What happens next

Confirming creates or updates what the preview showed. The operation row keeps the status and the errors file. Large work is queued; inviting users and printing posters remain separate steps.

Troubleshooting

A step is missing. The page shows only the jobs your role can perform. A manager scoped to Locations may not see the organization-wide setup step.

The preview finds unexpected invitations. Check the email and role columns and whether the people already have compatible pending invitations.

Nothing was created. Nothing changes until you confirm. Review the preview and the operation result.

Related features

• Bulk setup: Locations and managers
• Bulk invitations
• Large imports and scale

What this does

Bulk setup reads a CSV row by row and works out what each row is trying to do: create or update a Location, invite a person, or both.

Templates

Templates are starting points, not upload requirements. The planner accepts the canonical fields in any sensible combination.

The canonical fields

• location_id — CandorVoice reference such as LOC-12.
• location_code — your own site code.
• location_name — site name.
• address, timezone — site details; timezone is validated against the IANA database.
• location_group — a GRP-N reference or an exact Group name.
• email — the person this row is about.
• role — workspace role; a blank role in Locations + managers means Location Manager.
• user_internal_code — your own employee number.
• primary_manager — yes/no; the site's primary contact, not a permission.

How to use it

1. Open Bulk Operations and choose Set up Locations & Managers.
2. Download a template or prepare your own headings.
3. Upload the CSV and choose Review CSV columns.
4. Check the mapping and the preview: Locations to create/update, invitations to prepare, existing members to update, and row issues.
5. Confirm.
6. Follow the operation status and download the errors file if anything failed.

One person, many Locations

Fifty rows naming the same manager produce one invitation with fifty scopes and one email, not fifty invitations. If a compatible pending invitation already exists, it is reused and the Locations are added.

Common scenarios

A simple store list. Use location_name,email; every row creates a Location and prepares a manager invitation.

Locations without managers. Use the Locations-only template and invite people later.

A manager with a regional set. Add the Locations to a Group first, then use the Group in the file.

Common mistakes

• Using a Location name where a LOC-N is required.
• Repeating the same email with conflicting roles; resolve the conflict before confirming.
• Assuming a blank cell removes data. It does not.
• Forgetting that the uploader cannot grant a Location outside their own scope.

What happens next

The importer creates or updates Locations, prepares invitations, and reports the results. A manager invitation is pending, not active access. The new Locations are ready for posters only after the import completes.

Troubleshooting

The file is rejected. Check the template headings, required row meaning, timezone validity and Group reference. Read the row errors rather than guessing.

A Location was not created. Check for a duplicate or an invalid row. The errors file says which row and why.

The manager count looks wrong. Several rows for one person become one invitation with several scopes.

Related features

• Bulk invitations
• Location Groups
• Large imports and scale

What this does

The invitation CSV invites managers and team members in bulk. It is the same four-stage flow: download a template, upload, review, confirm.

Columns

The canonical invitation file uses:

• email;
• role;
• location_ids — LOC-N references separated by a vertical bar, for example LOC-1|LOC-8|LOC-12;
• optional location_group_ids — GRP-N references.

An empty location_ids grants every Location, which is the normal new-member default unless a manager narrows it.

Validation

The review catches:

• a missing or malformed address;
• an address already on the team;
• an address already invited;
• an unknown role;
• an unknown Location or Group reference;
• a duplicate Location inside one row;
• an email repeated in the file;
• a Location the uploader may not administer.

What happens on confirm

Every invitation is created in one transaction, then the emails are queued through the same path as a single invitation. The result reports invitations created and emails queued. A thousand rows do not become a thousand duplicate accounts.

Common scenarios

A new region. One file with the regional managers and their LOC-N scopes.

A person covering several sites. One row with all the Location IDs; one invitation and one email.

A mistake in one row. Fix the row or let the valid rows import and review the errors file. One bad row does not invalidate the file.

Important details

• A pending invitation is not a user.
• The uploader's own scope limits every grant in the file.
• Resending is a separate action after the cooldown.
• Invitation tokens are secrets; do not share the CSV or email link publicly.

What happens next

The invitations are created and queued through the normal invitation path. The result reports created invitations and queued emails. Acceptance creates the users and applies the named scope; the invitation rows stay as history.

Troubleshooting

Some rows were rejected. Check malformed addresses, existing members, existing invitations, unknown roles, unknown Location/Group IDs and duplicates. Fix the rows or use the valid ones.

An invitation email was not delivered. Check the invitation state for Send failed and resend after the cooldown if appropriate.

A person already invited to a compatible scope. The planner may reuse the invitation and add Locations; it does not create a second account.

Related features

• Invitation lifecycle
• Team and invitations
• Bulk Operations overview

What this does

Large files are processed in bounded work rather than loading the whole estate into the browser. The operation row is the record of what happened.

What stays bounded

• Location lists use server-side pagination and search.
• The CSV preview pages through rows.
• Imports are validated and committed in controlled batches.
• Large invitation resends and poster packs queue.
• Poster downloads for large selections become a ready file rather than holding the request open.

What to check after a large run

• the operation status;
• created/updated counts;
• invitations prepared;
• errors file;
• any rows skipped as already up to date;
• poster pack readiness.

Common scenarios

10 Locations. A small file can be reviewed and confirmed in one pass. Use the same validation as a large file; do not skip the preview.

1,000 Locations and managers. Use the Locations + managers template. Review the invitation count before confirming.

5,000 team rows. The same invitation rules apply; expect a queued result for large sends.

1,000 posters. Use the shared design and the multiple-poster pack. Do not download one at a time.

What happens next

The operation row records the status. A completed import shows what was created or updated and any row errors. A queued operation stays visible until the worker finishes. Invitation emails are queued through the normal invitation path; a successful import is not the same as every email being delivered.

Troubleshooting

The CSV was rejected. Check the headers, required values for the action that row is trying to perform, the Location or Group reference format, and the uploader's own scope.

Some rows failed. Download the errors file. Valid rows can still succeed; a failed row does not necessarily roll back the whole file.

The import is still processing. Large work is queued. Check the operation row rather than uploading the same file again.

A Location appears twice. Use LOC-N to target an existing Location and check the preview for duplicate handling. Do not rely on name matching when the file has a stable code.

The manager invitation count is lower than the row count. One person with several Locations becomes one invitation with several scopes.

Important details

• A large import does not load all Locations into the browser.
• A failed row is reported without discarding the valid rows.
• A Location not named in the file is untouched.
• Do not run the same file repeatedly expecting duplicates to accumulate; the planner recognises existing Locations and invitations.

Related features

• Bulk setup
• Bulk invitations
• Download options and large batches
• Enterprise scale

What this does

Settings → Data storage shows where selected workspace content is stored right now. There are two modes:

• CandorVoice managed — CandorVoice stores the content in its managed database.
• Customer-managed database — selected content lives in a MySQL 8 database controlled by your organization.

The page always starts with Current storage, so the active mode is never inferred from a card border.

What can live in the customer database

When customer-managed storage is active, the customer database holds selected free-text business content, including:

• Feedback message text and private follow-up messages;
• structured AI analysis output, where enabled;
• Action titles, descriptions, outcomes and comments;
• What changed wording;
• Poll questions, options and open-text answers;
• reminder wording and delivery subjects;
• generated report snapshots and saved report questions.

CandorVoice retains authentication, users, roles, Locations, categories, billing, QR/PIN security metadata, notification configuration, audit events and relational metadata. Poll structure, selected option IDs and aggregate counts remain central.

Current storage and saved profile

The page distinguishes the active storage from a previously configured customer database. Switching to CandorVoice managed keeps the encrypted customer database profile so you can switch back without typing it again.

Common scenario

“Our security team requires Feedback content in our own database.” Use a customer-managed MySQL 8 database, test the connection, prepare the schema, switch storage, and verify the content and health. The data boundary is listed on the Data storage page.

Important details

• The customer is responsible for backup and recovery of its own database.
• CandorVoice never deletes the customer's external database.
• The password is encrypted and never shown again.
• The page does not connect to the database on every page view; health is cached.

What happens next

Saving a connection stores an encrypted profile. Testing it refreshes the cached health/schema result. A switch is a separate verified operation; changing a connection does not move data or change the active storage mode by itself.

Troubleshooting

The page says Not configured. No complete customer profile is saved yet.

The connection is healthy but the schema is behind. Use Update database; this is separate from connection health.

The saved profile is not shown while managed is active. Check the connection state. A complete saved profile is retained across a switch to managed.

Related features

• Set up a customer database
• Switch storage safely
• Data storage troubleshooting

What this does

A customer-managed connection needs a reachable MySQL 8 database and an application user with access to that database.

The fields

• Host — hostname or IP address, for example db.company.com or 10.0.0.15.
• Port — MySQL normally uses 3306.
• Database name — the database CandorVoice should use.
• Database username — a MySQL user with access only to that database.
• Database password — encrypted at rest. Leaving the field blank uses the saved password.
• TLS — choose required with a CA certificate, or explicitly choose an unencrypted connection.

How to set it up

1. Open Settings → Data storage.
2. Choose Switch storage or Switch back to customer-managed database.
3. Enter the connection details.
4. Choose Save connection.
5. Choose Test connection.
6. Review the MySQL version, schema version and readiness.

What Test connection checks

• the network connection;
• authentication;
• the database exists and is reachable;
• the MySQL version is supported;
• the schema metadata is readable;
• the user has the privileges needed for the migration path.

It is read-only: it does not create or change the schema.

Saved password behaviour

If a password is already saved, the field is empty and shows Leave blank to keep saved password. A blank field on Test or Save uses the saved password. Only a newly typed password replaces it.

Common scenarios

A private database in a VPC. The endpoint must be reachable from CandorVoice through VPN, peering, a tunnel or an equivalent arrangement. A private address is rejected unless your deployment explicitly allows private hosts.

A TLS-only provider. Choose TLS required and provide the CA certificate. A missing certificate fails safely.

A rotated password. Enter the new password and save. The next test and the next operation use it.

Common mistakes

• Using a database user without schema privileges.
• Entering the server hostname as a URL or adding mysql://.
• Forgetting to update printed material after a PIN change (not a database issue, but the same “changed configuration” habit).
• Sending the database password in a support email. Never do that.

What happens next

A successful test refreshes the saved profile's health and schema state. It does not activate customer storage. A successful save keeps the connection profile for a later switch; the active mode is still shown at the top of the page.

Troubleshooting

Test connection fails with access denied. Check the username, password and database grants. Do not email the password to support.

Test connection fails with a TLS error. Check the CA certificate and whether the provider requires TLS.

Test connection succeeds but the switch is blocked. The workspace may have an active operation, or the connection has not passed the readiness checks. Read the page message.

Related features

• Switch storage safely
• Data storage troubleshooting

What this does

Switching storage moves selected content from the current database to the other mode. It is a verified migration, not a mode toggle.

Both directions

• CandorVoice managed → customer-managed database
• Customer-managed database → CandorVoice managed

The modal derives Where your content is now and Where it will move from the canonical active mode. It does not use a selected card or a stale form state.

What the switch does

1. Checks the source or prepares the customer connection.
2. Tests the customer connection and prepares or updates the schema.
3. Copies content in bounded background work.
4. Verifies counts and per-record hashes.
5. Takes a final frozen copy.
6. Activates the destination only after verification succeeds.

If anything before activation fails, the source remains active.

Switching back to saved customer storage

When CandorVoice managed is active but a customer profile exists, the page shows Previously configured customer database with its last known health and a Switch back to customer-managed database action. The non-secret fields are prefilled and the saved password is reused. You can test the connection again before continuing.

What is not deleted

Switching to CandorVoice managed does not delete the customer's database, tables or saved connection profile. CandorVoice does not own that database.

Common scenarios

A temporary move to managed storage. Switch back later using the saved profile; no connection re-entry is required.

A verification failure. The source stays active. Investigate the connection or destination, then retry.

A customer database outage. CandorVoice fails closed. It does not silently switch to central storage.

What happens next

On success, the destination becomes Current storage and new content writes use it. The source profile remains saved, health and schema status are shown, and the page records the latest switch/verification. On failure, the source mode remains active and the freeze is removed.

Troubleshooting

The switch button says Test connection first. The saved customer connection has not passed a test or is unavailable. Test it; if it fails, fix the connection before switching.

The switch is blocked by unsaved changes. Save the connection, then test it. The switch uses the saved profile, not a draft.

Verification failed. The source is still active. Check the destination and the operation error category, then retry. Do not manually flip a storage mode.

The customer database is unavailable. That is an outage, not a reason to fall back. Use Test connection and recovery guidance.

Important details

• New writes may pause briefly during final activation.
• Do not expect the customer database to be deleted by CandorVoice.
• Only one storage operation runs for a workspace at a time.
• The source remains authoritative until the destination verifies.

Related features

• Data storage overview
• Data storage troubleshooting

What this does

The Data storage page separates three facts that are easy to confuse:

• Connection health — can CandorVoice reach the database?
• Database schema — is the customer database at the version this product requires?
• Content migration — has the content copy/update completed?

Connection unavailable

If the customer database is unavailable:

• CandorVoice shows Customer database unavailable;
• it does not fall back to central content;
• it does not read retained central copies;
• Test connection and recovery guidance are shown.

Check the host, credentials, TLS and network access. Do not switch storage as a way to hide an outage.

Schema update required

If the product requires version 2 and the database is on version 1:

• the page shows Database update required;
• choose Update database;
• the canonical migration runs in the background;
• the previous version remains recorded until the new version verifies.

If the update fails, the page keeps the exact pending version and allows a safe retry. It does not silently run later migrations.

Content update

If a new content category was added after the workspace activated customer storage, Update customer database content copies and verifies it, then blanks any retained central values. It is separate from a schema update.

Common scenarios

The database password was rotated. Save the new password, test, then retry any failed operation.

The schema is behind after a release. Use Update database, not a manual SQL change.

A switch failed. The source is still active. Read the failure category, test the connection, and retry.

Important details

• Normal page views do not run schema changes.
• The application never falls back to central storage on an outage.
• A customer database profile is retained when you switch to managed.
• Never run manual schema changes against a customer database; use the product's Update database action.

Related features

• Set up and test a customer database
• Switch storage safely
• Support

What this does

Anonymous is the default on the employee form. The employee chooses whether to share a name; CandorVoice does not decide for them.

Anonymous

For an anonymous observation, no employee identity is stored with the Feedback. There is no name, email, account or recovered identity. A Location PIN and a scan are not identities.

Named

If the employee chooses Share my name, CandorVoice stores the name and optional email with the observation. The employee chose that. Do not turn a named observation into a public quote without permission.

What CandorVoice cannot claim

• It cannot say how many distinct employees submitted a set of anonymous observations.
• It cannot attribute an anonymous submitter to a reminder recipient.
• It cannot recover an identity that was never stored.
• It cannot prove that one scan equals one person.

Common scenarios

An anonymous safety report. Read and act on the content. Do not attempt to infer the author from wording or timing.

A named follow-up. Treat the name as personal data and share it only with people who need it.

A manager asks who wrote an anonymous message. Explain that the product does not store it and that attempting to deanonymize would break trust.

Important details

• Private follow-up uses a separate link and Password, not the employee's identity.
• The Location PIN is shared and does not identify a person.
• Public feedback pages are not search-engine-indexable management pages.
• Screenshots and exports can leave CandorVoice; handle them according to your policy.

What happens next

An anonymous submission stays anonymous; a named one keeps the identity the employee chose. Review and Action do not change that choice. A private follow-up is a separate conversation and does not make the original observation named.

Troubleshooting

A manager insists the author can be found. The identity is not stored for an anonymous observation. Do not attempt to infer it from timing, wording or device data.

A screenshot or export contains a name. Redact it before sharing outside the people who need it. The application boundary does not protect a file once it leaves CandorVoice.

An employee wants their name removed from a named submission. Follow your privacy process; do not promise an outcome the product does not support.

Related features

• Privacy and security controls
• Privacy requests
• Reminder privacy

What this does

CandorVoice separates workspaces and applies permissions underneath the screens. A manager sees only the Locations and records their membership allows.

Workspace separation

Every workspace is a separate boundary. Records, settings, invitations, reports and customer database connections belong to one workspace. A filter cannot widen access to another workspace.

Location scope

Location scope applies to Feedback, Actions, Polls, What changed, Reports and Ask CandorVoice. A Group change can narrow or widen a manager's future access immediately.

Roles and permissions

Roles decide what a person can do. A Location Manager role is deliberately narrower than a workspace administrator. Seeing Feedback is separate from changing Actions or settings.

Audit trail

The Audit trail records management and security changes with safe before/after values. It is read-only in the product. It never stores a password, employee observation text or an Action outcome.

Security settings

Settings → Security covers the viewer's own authentication and any workspace-wide MFA requirement. Recovery codes and passwords are never written to the audit trail.

Encrypted credentials

AI provider keys, customer database credentials and other secret configuration are encrypted at rest and hidden from serialization. The product shows only masked or last-four information where appropriate.

Common scenarios

A manager changes sites. Update their scope; the next request uses the new access.

A customer database is compromised. Rotate its password outside CandorVoice, save the new password, and test. Do not send the credential in support email.

A security review asks for audit evidence. Use the Audit trail and the documented security controls. Do not claim a certification the product does not hold.

Important details

• Security is fail-closed for customer-managed content.
• A customer database outage does not trigger central fallback.
• A screenshot or export is outside the application's access controls; handle it carefully.

What happens next

A scope change applies to the next request. A credential rotation applies after the new password is saved and tested. A security setting change is recorded in the audit trail where the product audits that action.

Troubleshooting

A manager sees a Location they should not. Check explicit Location access, Group membership and whether the Location moved into a granted Group.

A manager cannot see a Location they should. Check the current Group or explicit list, the invitation state and the page's own capability.

A customer database is unavailable. Treat it as an outage; do not switch to managed storage as a shortcut and do not read retained central copies.

An audit entry is missing. The audit trail records management changes, not every read. Absence of an entry is not proof that an action happened outside CandorVoice.

Related features

• Settings: Audit trail
• Settings: Security
• Privacy requests

What this does

Privacy requests is the workspace's record of requests that need a privacy workflow. It is not a public form and is not visible to another customer.

Who can use it

Access requires the workspace's privacy capability. A Location-scoped manager does not gain privacy administration through managing a site.

What a request can cover

The exact actions depend on the request and the product's current privacy tools. The workspace may need to:

• locate the relevant records;
• export information;
• apply a retention or deletion process;
• record the decision and the outcome.

CandorVoice does not invent a legal conclusion. Your privacy lead decides how the request applies.

Common scenarios

An employee asks what is held about them. Use the privacy workflow and the relevant records. An anonymous observation cannot be linked to a person who was never identified.

A customer asks for deletion. Follow the documented retention and deletion process, including customer-managed storage if active.

A request arrives for another workspace. Refuse it; workspace separation applies.

Important details

• Privacy requests are workspace-scoped.
• Exports and deletion are audited.
• A customer-managed database may require action in the customer's own database and backup process.
• Do not send raw employee Feedback in a support email.

Related features

• Settings: Privacy & data
• Privacy and security controls

What this does

Ask CandorVoice uses the workspace's own AI provider connection. The provider request contains only the minimum evidence bundle needed to answer the question.

What is sent

• the manager's question;
• a bounded, authorized evidence set from CandorVoice records;
• instructions that constrain the answer to that evidence.

What is not sent

• API keys or authorization headers;
• employee PINs, QR tokens, passwords or invitation tokens;
• IP addresses, device fingerprints or spam identifiers;
• billing or audit internals;
• anonymous submitter identities (there are none to send).

Provider choice

Each workspace connects its own OpenAI, Claude, Gemini or DeepSeek account and chooses one active provider. There is no platform-key fallback or automatic provider switch.

Common scenarios

A security review asks whether employee text leaves CandorVoice. Explain that only a bounded evidence set for an Ask question may be sent to the workspace's selected provider when the feature is enabled. Basic Feedback, Actions, Polls and reports do not call AI.

The provider contract changes. The workspace administrator updates the key/model and tests the connection.

A question asks for an anonymous author. Ask CandorVoice refuses; the identity is not stored.

Important details

• Ask CandorVoice is read-only.
• The answer must cite the supplied evidence.
• If evidence is insufficient, it says so.
• The usage ledger records metadata, not the question/answer content.

Related features

• Ask CandorVoice overview
• Connecting an AI provider
• Privacy and security controls

What this does

The Audit trail shows who changed what, when, and in which workspace area. It is a read-only accountability record.

Who should use it

Workspace administrators and people with the audit capability. It is not part of the daily manager workflow and is not visible to a normal Location Manager by default.

What it records

Examples include Location activation/deactivation, PIN protection and PIN changes, Action changes, invitation actions, storage switches and schema updates. Records carry safe before/after values such as a name, date or status.

What it never records

• passwords or recovery codes;
• API keys or database passwords;
• employee Feedback text;
• private conversation content;
• raw invitation tokens.

Common scenarios

A Location was deactivated unexpectedly. Filter the audit trail for the Location and time, then verify who made the change.

A manager asks when an Action was completed. The Action page shows its own activity; the audit trail provides the workspace-wide record.

Important details

• The trail cannot be edited or deleted in the product.
• Absence of a record is not proof that nothing happened outside CandorVoice.
• Use LOC-N, ACT-N, CHG-N or a safe event label when discussing a record with support.

Related features

• Actions overview
• Privacy and security controls

What this does

General settings hold the workspace-level identity and defaults that do not belong to a single Location. The exact fields visible depend on your role and the deployment's configuration.

Who should change it

Usually a workspace administrator. A normal manager should not change workspace identity or global reminder policy.

What to check

• the workspace name and customer-facing identity;
• the timezone used where a workspace-level time is needed;
• management reminder preferences;
• any allowed branding fields.

Common scenarios

The company name changed. Update the workspace identity; verify how it appears on posters and emails.

Managers are not reviewing Feedback. Consider the management reminder settings, but first check whether the team has a review routine.

Warnings

• Do not put a personal email address or a temporary brand in a permanent workspace field.
• Changing a workspace-level reminder does not rewrite an already scheduled Location reminder.

Related features

• Settings: Notifications
• Feedback reminders
• Poster design

What this does

The Notification Center decides what reaches whom. It covers personal alerts and the workspace's shared notification rules.

Who should change it

Every member can manage personal notification preferences. Shared rules, external recipients and workspace-wide delivery history require the notification-rule capability.

What you can configure

• personal important-alert preferences;
• event rules such as Action assignment, due/overdue, QR inactivity or new Feedback;
• scheduled reports;
• internal and verified external recipients;
• delivery history.

Common scenarios

A manager wants assignment emails. Keep the personal important-alert switch on and confirm the workspace rule exists.

A new external recipient. Add the address, complete the signed verification link, and only then can it receive reports.

A noisy rule. Pause the rule rather than deleting the history.

Important details

• CandorVoice does not claim delivered, opened or read.
• A failed delivery is recorded as a safe category.
• External recipients must be verified; do not type an unverified address into a report.
• A Feedback reminder recipient is not a report reader.

Related features

• Reports delivery
• Feedback reminders
• Actions ownership and alerts

What this does

Settings → Security covers the viewer's own authentication and, for authorized administrators, the workspace-wide MFA requirement.

Personal security

Depending on deployment configuration, a person can manage:

• a passkey;
• an authenticator app;
• recovery codes;
• password/sign-in options.

Workspace-wide MFA

An authorized administrator can require MFA for workspace members. The requirement applies to members' next authenticated access; it is not a substitute for role and Location scope.

Common scenarios

A new laptop. Add a passkey or authenticator and keep recovery codes somewhere safe.

A security review. Require MFA for the workspace, then confirm every administrator can enrol.

Warnings

• Recovery codes are shown only at enrolment; store them securely.
• CandorVoice never writes a password or recovery code to the audit trail.
• Do not send a recovery code to support.

Related features

• Privacy and security controls
• Settings: Audit trail

What this does

Feedback categories are the choices an employee sees on the public form. Each Category has a display name and a Category priority used to colour and rank that Category in intelligence.

Who should change it

Workspace administrators or people with the settings capability. Changes affect the employee form and management filters.

How to use it

1. Open Settings → Feedback categories.
2. Review the default list.
3. Add a Category only when it is genuinely distinct from the existing choices.
4. Set the Category priority used for intelligence display and ranking.
5. Disable a Category instead of deleting history.

Common scenarios

A new safety topic. Add a Category if the existing Safety group is too broad; keep the name employee-friendly.

A Category nobody uses. Disable it rather than deleting it, so historical Feedback keeps its label.

Important details

• The employee chooses the Category; CandorVoice does not silently reclassify it.
• Every new Feedback starts at None; Category priority never assigns urgency on the employee's behalf.
• Feedback Priority is a management urgency marker, not an employee judgment.
• A Category is not a Location and does not affect access.

Related features

• Feedback inbox
• Review and priority

What this does

This page holds the workspace's own AI provider connections for Ask CandorVoice.

Who should change it

A workspace administrator. Normal managers use Ask CandorVoice but do not see provider or key configuration.

What you can do

• connect OpenAI, Claude, Gemini or DeepSeek;
• save an encrypted API key;
• set an optional model override under Advanced;
• test a connection;
• choose Use for Ask CandorVoice;
• enable or disable the feature.

What happens after a change

Replacing a key or model requires a fresh test. Disconnecting the active provider disables Ask CandorVoice; another provider is not selected automatically.

Warnings

• Never paste a provider key into a support email or a screenshot.
• There is no platform-key fallback.
• A saved key is shown only in masked form after saving.

Common scenarios

A new provider is approved. Connect it, test it, choose Use for Ask CandorVoice, then enable the feature.

The active key expired. Replace it, test again and re-enable if necessary. Do not expect an automatic provider switch.

A provider is temporarily down. Ask CandorVoice fails with that provider named. Another saved provider is not called automatically.

Troubleshooting

Ask CandorVoice says no active provider. A connection may be saved but not tested, or the active provider was disconnected. Test and choose one explicitly.

The feature will not enable. The active connection has not passed the structured test.

The key field shows only dots or the last four characters. That is the saved-key state. Enter a new key only to replace it.

Related features

• Ask CandorVoice overview
• Connecting an AI provider
• Ask CandorVoice limits

What this does

Privacy & data holds the workspace's data lifecycle controls. The exact controls depend on the deployment and the viewer's privacy capability.

Who should change it

A privacy administrator, not a Location Manager. Retention and deletion decisions can be consequential and should follow the organization's policy.

What to review

• retention periods;
• retention holds;
• deletion/anonymisation choices;
• the workspace erasure path where available;
• privacy request links.

Common scenarios

A legal hold. Apply a hold before a retention pass would delete the relevant records.

A retention review. Confirm the periods match policy, then record the decision.

Warnings

• Deleting data is not a substitute for a retention decision.
• A customer-managed database may require action in the customer's own backup and retention process.
• Do not claim a compliance certification CandorVoice does not hold.

Related features

• Privacy requests
• Privacy and security controls

What this does

Settings → Data storage shows the active storage mode, the saved customer database profile, connection health and schema status.

Who should change it

A workspace administrator with the data-storage capability. A normal Location Manager should not be able to change where content is stored.

What you can do

• test the saved customer connection;
• save or replace connection details;
• switch between CandorVoice managed and customer-managed storage;
• update the customer database schema when required;
• switch back to a previously saved customer database.

Common scenarios

A security requirement for a customer database. Set up and test the connection, prepare the schema, switch storage, and verify content.

A schema update after a release. The page shows Database update required and an Update database action.

Warnings

• Never send the database password to support.
• Switching does not delete the customer database.
• An unavailable customer database fails closed; it does not fall back to central content.

Related features

• Data storage overview
• Switch storage safely
• Data storage troubleshooting

What this does

Privacy requests is the workspace's operational queue for privacy requests that need a response. It is not public and belongs to one workspace.

Who should use it

The workspace's privacy lead or an administrator with the privacy capability. A Location Manager does not gain it through managing a site.

How to use it

1. Open a request.
2. Read what is being asked.
3. Locate the relevant records using the privacy tools.
4. Export, retain, restrict or erase according to policy.
5. Record the decision and the outcome.

Common scenarios

An access request. Provide the information the product can locate, without exposing another person's data.

An erasure request. Follow the retention and deletion process, including customer-managed storage if active.

A request about an anonymous observation. CandorVoice may be unable to link it to a person because no identity was stored. Explain that clearly.

Important details

• Do not send request details or employee Feedback in an ordinary support email.
• Every consequential action should be traceable in the audit trail.
• A customer-managed database may require action by the customer's own data team.

Related features

• Privacy requests
• Privacy & data settings

What this does

Subscriptions shows the workspace's plan and renewal state. It is a management surface, not a pricing catalogue.

When a Creem trial is active, the subscription shows the trial end and the first payment date and amount. The plan's Location allowance applies during the trial.

What you can see

• plan;
• price;
• status;
• next renewal;
• whether it renews automatically;
• the cancellation effective date when a cancellation is pending;
• the free-trial end and first expected payment when a trial is active;
• discounts where they apply.

Common actions

Depending on the current subscription and provider:

• Change Plan;
• Cancel Subscription;
• Discard Cancellation;
• Update Payment Details;
• Add Discount;
• View Details.

Common scenarios

A plan no longer fits the estate. Use Change Plan and review the effect before confirming.

A cancellation was started by mistake. Use Discard Cancellation where it is offered.

A payment method changed. Update payment details through the provider's secure flow.

Important details

• CandorVoice does not store card details.
• The available plans and prices come from the current product configuration; this manual does not invent contract terms.
• A failed payment can affect access or renewal according to the provider flow.
• Contact support for a billing question; do not email card details.

What happens next

A plan change, cancellation, payment-detail update or discount is applied through the provider flow and reflected in the subscription/status view. A scheduled cancellation keeps the plan active until its effective date and can often be discarded before then. If the provider cancels immediately, the subscription becomes Inactive immediately. The exact state and effective date are shown on the subscription.

Creem trial subscriptions cannot change plan while they are still trialing. Continue the trial and change plan after it becomes active, or cancel the trial first.

Troubleshooting

The plan change did not appear immediately. Refresh the subscription view and check the provider's processing state.

Cancel Subscription is missing. The current status or role may not allow cancellation, or a cancellation may already be pending.

A payment failed. Check Payments, update payment details where offered, and contact support without sending card data.

Related features

• Payments
• Support

What this does

Payments lists the workspace's payment records and links to invoices where available.

What you can see

• amount;
• status;
• owner/payer where shown;
• date;
• See Invoice.

How to use it

1. Open Payments.
2. Use the date and status columns to find the record.
3. Choose See Invoice to open the invoice.
4. Contact support if a payment or invoice looks wrong.

Common scenarios

An invoice is needed for finance. Open the payment and download or view the invoice through the provided action.

A payment failed. Check the status, update payment details under Subscriptions, and contact support if it remains unresolved.

Important details

• CandorVoice stores no card details.
• Payment records come from the provider.
• Do not send card numbers or bank credentials to support.

What happens next

The payment record and invoice reflect the provider's accepted transaction. A failed or pending payment stays visible with its status. CandorVoice does not store the card details used.

Troubleshooting

A payment is missing. Check the date range and whether the provider has completed the transaction.

The invoice will not open. Try the browser's normal link handling or contact support with the payment date and amount, never the card number.

The status looks wrong. Refresh the record and contact support with the payment reference; do not send bank credentials.

Related features

• Subscriptions
• Support

What this does

The public affiliate program page explains how to join CandorVoice's program through Creem and how affiliates can share either their Creem link or a branded CandorVoice link.

Creem remains responsible for affiliate applications, referral attribution, commissions, identity verification and payouts. CandorVoice does not hold affiliate balances, bank details or KYC documents.

Affiliate Marketing Playbook

Choose Download Affiliate Playbook in the page hero or Download Free Playbook (PDF) from any of the three section banners. The playbook is a free 12-page PDF and opens without an account, registration or lead form.

It includes practical outreach ideas, example conversations, industry scenarios, evidence guidance and the guardrails affiliates should use when describing CandorVoice. Every download link points to the same PDF in the current environment's public storage.

How to join

1. Open Affiliate Program from More or the public footer.
2. Choose Join affiliate program and submit the application in Creem.
3. Complete Creem onboarding and wait for Creem approval.
4. Open the Creem affiliate dashboard and copy the personal affiliate link shown there. The page displays an italic example so it is not confused with your real link.
5. Share that Creem link directly, or return to CandorVoice and choose Generate CandorVoice link.

Creem handles affiliate approval. CandorVoice does not ask for a second application, contact details or a separate approval.

Branded partner links

Enter the canonical Creem affiliate link on the Affiliate Program page and choose Generate CandorVoice link. A stable numeric branded address such as /partner/1 is created or returned immediately. The page uses candorvoice.com/partner/X only as an illustrative example; X is replaced by your actual assigned partner number.

The result appears below the form without reloading the page or moving the visitor back to the top.

The address always sends the visitor through Creem's own affiliate link before returning to CandorVoice. This preserves Creem's tracking, attribution and commission process.

The same Creem code returns the same branded address, even when submitted again. A branded link can be disabled for security without changing its number; unknown or disabled addresses do not redirect.

Pasting a Creem link does not establish identity or prove ownership. Commission attribution remains attached to the original Creem affiliate code.

Partner customer offer

When a customer arrives through an eligible branded CandorVoice partner link, CandorVoice may show a partner offer. Eligible referred customers can use the displayed code under Have a coupon code? on the normal checkout.

The offer is shown only while CandorVoice has an active eligible promotion configured. Plan eligibility, expiry and redemption limits come from the existing discount configuration. The popup does not bypass checkout validation or change the trial.

A direct Creem affiliate link still works and still uses Creem's native referral tracking, but it does not display the branded-link partner offer.

Earnings examples

The Affiliate Program page shows all currently published plans in their configured order and estimates an illustrative 30% commission after an assumed Creem processing fee of 3.9% + $0.40 per successful payment. The estimate uses the current backend monthly price and does not hardcode prices or commission amounts.

The page hero explains that affiliates earn 30% Lifetime Recurring Commissions and that the 30% commission continues every month for as long as each referred customer keeps paying.

An interactive calculator lets visitors choose a business size, a number of paying businesses and a subscription period. Plan choices use labels such as Business with 51–100 Locations. It shows the estimated commission per business per month, the monthly total and the selected-period total. The same rounded per-payment commission is used in the table and calculator. All results update in the browser without a page reload.

These are estimates only. The simplified model assumes each selected business makes one successful full-price payment each month; the free trial is not a successful payment. An additional 5% recovered-cart fee may apply. Creem also describes a separate 2% affiliate-platform fee. Other Creem fees, discounts, taxes, refunds, failed payments and cancellations can change actual earnings. Creem determines final commissions and payouts.

How payouts work

Creem manages earnings and payouts. Under the current published program, the commission is 30% recurring lifetime with a 90-day referral attribution window.

Use the Creem affiliate portal for verification, payout methods, eligibility and current payout details.

Who to recommend CandorVoice to

The page helps affiliates recognise businesses where employees see problems, risks or better ways of working before management does. It includes illustrative examples for manufacturing, warehousing, retail, food service, hospitality, healthcare and transport.

These examples are not verified reports from CandorVoice customers. CandorVoice does not replace emergency, safety or legally required incident-reporting channels.

Useful questions to ask a potential customer are:

• "Do your employees have an easy way to share problems and ideas with management?"
• "Can employees see what changed after they speak up?"

The page also explains six possible improvements from listening and acting: spotting risks earlier, improving safety, finding better ways of working, encouraging ideas, building trust and engagement, and improving productivity and profitability. These are potential improvements, not guaranteed results of using CandorVoice.

Employee engagement research

The page cites the independent Gallup Q12® Meta-Analysis — 11th Edition (2024). The published scope is 736 studies, 347 organizations, 53 industries, 90 countries, 3,354,784 employees and 183,806 business/work units.

Gallup reports median differences between top-quartile and bottom-quartile employee-engagement business units: 63% fewer safety incidents, 32% fewer quality defects, 21–51% lower turnover, 78% less absenteeism, 14% higher productivity and 23% higher profitability.

The productivity result comes from production records and evaluations; Gallup separately reports an 18% sales-productivity difference. Turnover was 21% lower for high-turnover organizations and 51% lower for low-turnover organizations.

This is independent Gallup research, not a CandorVoice study or customer result. Gallup did not study or endorse CandorVoice, and using CandorVoice does not guarantee these outcomes.

View the Gallup research

Common scenarios

A partner has a Creem link but no branded link. Paste the canonical Creem link on the Affiliate Program page and choose Generate CandorVoice link.

A partner submitted the same link twice. CandorVoice returns the existing branded link instead of creating a duplicate.

A customer copied a partner link but did not see a popup. The customer must arrive through an eligible branded CandorVoice partner link while an active configured offer exists. Direct Creem links do not show the branded-link offer.

What happens next

The partner immediately sees the full branded URL and can copy it to share. A customer who opens it passes through Creem and returns to CandorVoice. Creem reports attribution and conversion in its own affiliate portal; a CandorVoice page view alone is not evidence that a commission was earned.

An administrator can disable a mapping if abuse is found. The numeric address remains reserved but stops redirecting immediately.

Troubleshooting

The Creem link was rejected. Use the exact canonical HTTPS link from the Creem affiliate portal with no added redirect or tracking parameters.

The branded link says it is unavailable. The mapping has been disabled for security. Contact support if you believe it should be reviewed.

The discount code is rejected at checkout. Check that the selected plan is eligible and that the offer is still active. Trial terms and provider validation remain unchanged.

Related features

• Subscriptions
• Payments
• Support

What this does

CandorVoice is designed so a large Location list does not need to load every record in the browser. Search, filters and pagination run on the server.

Where scale shows up

• Locations: server-side search, filters and pagination.
• Bulk Operations: preview, validation and confirmation for large CSV files.
• QR & Posters: paginated Location list; large poster selections become a queued pack.
• Team and invitations: server-side list, bounded resend batches.
• Feedback: filtered list and streaming CSV export.
• Reports: frozen snapshots and bounded report sections.
• Customer-managed storage: background copy, verification and progress.

A practical large-workspace setup

1. Import Locations and managers with Bulk Operations.
2. Check the operation result and errors file.
3. Confirm the Locations and manager readiness.
4. Print posters by Group or batch.
5. Give regional managers Group access.
6. Set a small number of reports rather than one per manager.
7. Use Ask CandorVoice only where it improves a management decision.

Common scenarios

1,000 Locations. Use the two-column Locations + managers file and a shared poster design.

100,000 Feedback records. Normal lists remain paginated; exports stream. Do not expect a page to load the whole dataset.

A regional manager with 200 sites. Give them a Group rather than 200 individual scopes.

Important details

• A large list is not a performance report; page size and filters matter.
• Bulk operations are authorized by the uploader's own scope.
• Customer-managed storage is the Enterprise option when content must remain in the customer's own MySQL 8 database.
• Do not judge a Location by volume alone.

What happens next

A large import or poster selection moves into a bounded background operation when needed. The operation row and the relevant list show the result. Large lists remain paginated; no page loads the whole estate.

Troubleshooting

A large page feels slow. Check the filter/page size and avoid exporting or selecting the entire estate when a Group is enough.

A bulk operation is still processing. Large work is queued; check the operation status instead of resubmitting.

A manager cannot see 200 Locations. Use a Group rather than maintaining a huge explicit list, and verify the Group is current.

Related features

• Bulk Operations overview
• Download options and large batches
• Data storage overview

What this does

This checklist keeps a large workspace deliberate: clear ownership, current access, visible channels and a small reporting rhythm.

Weekly

• Review the Home attention list.
• Check unreviewed Feedback and overdue Actions.
• Confirm completed work that should be shared under What changed.
• Look for quiet Locations and manager readiness gaps.

Monthly

• Review Locations and Groups for changes.
• Review who has workspace-wide access.
• Check poster coverage and PIN changes.
• Review report recipients and delivery failures.
• Review customer-managed storage health and schema status if used.

Quarterly

• Review roles and permissions.
• Review privacy and retention decisions with the privacy lead.
• Review AI provider connections and active models if Ask CandorVoice is enabled.
• Review bulk imports and any recurring data processes.

Common scenarios

A new region. Create a Group, import the Locations, invite the regional manager with Group access, and print the posters.

A security review. Use the audit trail, access list, customer-managed storage status and privacy requests as evidence. Do not claim certifications the product does not hold.

Important details

• Do not give workspace-wide access to solve a single-Location problem.
• Keep the number of reports useful; a report nobody reads is noise.
• A large workspace still needs a human review routine.

What happens next

The weekly, monthly and quarterly reviews turn into a small number of durable habits. Each review links to the current records; none of it creates a separate reporting system.

Troubleshooting

The weekly review is too long. Reduce it to the Home attention list, unreviewed Feedback and overdue Actions.

A regional report is missing Locations. Check the Group and the report scope.

A customer-managed database needs attention. Use the Data storage health/schema page and the documented recovery guidance; do not bypass the fail-closed behavior.

Related features

• Roles and scope
• Enterprise scale
• Bulk Operations overview
• Privacy and security controls