Performance data is people data. We handle it that way.
A review is about a person, so Pointed Performance treats it with care at every step: visible only to the right people, kept as it was released, and never decided by an algorithm.
- Access follows the role
- Reviews kept as released
- People decide, AI drafts
- ScoringReviewers describe each skill on the same scale
- AlignmentSelf and manager views are compared first
- ReleaseAn owner or admin decides when results are sharedYou decide
- After releaseThe review is frozen as it was released
Treat a review like the personal data it is
The hardest security question for a review tool is not who can break in. It is who sees what, and when. Four ideas shape how Pointed Performance is built.
You choose the moment
Gaps are talked through first, then an owner or admin decides when results are shared. Nothing arrives as a surprise.
Seen only by the right people
Access follows the role, and every goal has its own visibility. The default is the narrowest sensible one.
Kept as it was released
A released review is frozen. Later changes to a role or a template never rewrite what people were told.
Human decisions, AI support
AI prepares drafts. A person decides every rating, goal and message.
Who can see what?
Pick a question. See how Pointed Performance answers it.
- Review ManagerRuns cycles and owns templates.CyclesTemplatesResults
- Finance ManagerLooks after plan and billing.BillingPlan
- Everyone elseSees their own reviews and goals.Own resultsOwn goals
Security is not an upsell
The protections that matter most come with the free trial and every plan. Enterprise adds more controls on top, never the basics.
Secure by default, from the foundations
There is nothing to switch on. From your first review, your company’s data stays your own and every action is checked against the person’s role, on every plan, with no setup.
Access that follows the role
Three levels, and each one gets only the controls it needs.
You pick who sees each goal
A direct manager, the manager chain or the whole company. The default is the chain.
A released review cannot be rewritten
Results are frozen the moment they are released. Change a role or a template later, and the review people already saw stays exactly as it was.
AI secured from the ground up
Pointed AI was designed inside the same security model as the rest of the product, not added on top. Each company gets its own keys, it works only with what the person asking can see, and it only drafts. Its three jobs: suggest goals, draft feedback and show how skills move.
Walled off, company by company
Each company has its own key for each AI feature. Keys are stored encrypted and never appear in responses or logs, so one company’s AI use stays separate from another’s.
- One key per company and per AI feature
- Keys stored encrypted
- AI runs only when a person asks for it
Drafts, never decisions
Every suggestion waits for a person to keep, edit or drop it.
Shows where it came from
Each suggestion names the part of the review behind it.
Inside the access you set
Answers use only what the person asking is already allowed to see.
Yours to switch off
AI is a company setting. Reviews, goals and skill history work without it.
More control for larger organizations
Enterprise teams connect Pointed Performance to the way they already manage people and access, and keep a record of what changed.
- Sign in through your identity provider
- Joiners and leavers follow your directory
- Groups mapped to access levels once
- API tokens with a limited scope that you can revoke
Security, answered
Who can see a review?
The people involved in the review and the roles that run the cycle. Everyone else sees only their own reviews and goals.
Is our data kept separate from other companies?
Yes. Every record belongs to one company, and every request is limited to the company of the person making it.
Can a review change after it is released?
No. A released review is stored as it was released, so later edits to a role or a template do not rewrite it.
Who controls access to Pointed Performance?
Owners and admins manage people, invitations, company domains, the plan and API keys. Members do not have those controls.
Can we sign in with our identity provider?
Yes, on Enterprise, which adds single sign-on and SCIM provisioning so people join and leave with your directory.
What does the AI do with our data?
It drafts goal suggestions and written feedback from your reviews and shows skill trends. Each company has its own AI keys, and suggestions are never applied without a person. Ask the security team for details on providers and data handling.
Can we turn AI off?
Yes. AI is a company setting. Reviews, goals and skill history work without it.
How do I report a vulnerability or ask a security question?
Email security@pointedperformance.com. We read it, and a person replies.
Have a security question?
Send your questions, a questionnaire or a vulnerability report, and our team will answer directly.