High priority · Reproduced
Demo organizations are presented as currently certified workplaces.
Observed: /certified says it contains “Every currently certified company that chose to be listed.” Its detail pages describe closed anonymous surveys and state that “The survey is real.” The explicit demo dashboard, however, identifies itself with “Leave demo” and “Sign out of Synergex Dynamics,” while Synergex Dynamics also appears in the public certified list without a sample or demo label.
Why it matters: A first-time HR buyer cannot tell where demonstration data ends and customer proof begins. That ambiguity is especially costly for a product whose value rests on independent certification.
Change: Mark every seeded organization and score as “Demo company · sample data,” or split sample records from verified live certifications.
Acceptance check: A visitor opening the homepage carousel, list, any sample detail, or demo dashboard sees the same sample-data status before interpreting a score as customer evidence.
High priority · Observed
The signup commitment point does not expose Privacy or Terms.
Observed: /signup collects a name, company, headcount, work email, and password. The page offers no Privacy or Terms link beside “Create account,” and neither policy appears in the public footer or sitemap retrieved during the check.
Why it matters: The homepage makes specific promises about anonymous workforce responses and IP-address handling. A buyer evaluating those promises cannot inspect the account-data terms at the point where personal data is first requested.
Change: Link Privacy and Terms beside the account action and in the global footer. State the controller/contact, account and survey-data retention, subprocessors, user rights, and the boundary between employer account data and anonymous responses.
Acceptance check: A signed-out visitor can reach both policies from the signup page without submitting data, and each policy has an owner, effective date, retention rules, and contact route.