Privacy & Data

There are two ways in, and they are deliberately different because they grant different things.

Leader and administrator accounts — the surfaces that show many people — require Merkle credentials plus app-based two-factor authentication (TOTP). Two-factor secrets are encrypted at rest and recovery codes are stored only as hashes. Viewers are folder-scoped: they see only the regions and workspaces assigned to them, enforced on the server for every request rather than hidden in the interface. Administrators see everything. Sessions use encrypted cookies and expire automatically.

My Profile — where a person views their own record — has no account and no password. You enter your work email and we send a short-lived link to that address; email is the identifier, and receiving the link is the proof that the inbox is yours. The link opens a read-only view of one person's record — yours — and grants access to nothing else. It expires within the hour and is stored only as a one-way hash, so nobody reading the database can mint a working link. It tolerates being opened more than once inside that window because corporate mail security pre-fetches links before a human clicks them. Requests are rate-limited, and the response is identical whether or not the address matches a record, so the form cannot be used to discover who is on the roster.

People data is pulled from Salesforce via read-only queries — nothing is ever written back to Salesforce. It covers work-context attributes such as name, work email, manager, title, region/country, cost center, certifications, and engagement/skillset scores. This is employee data and is treated with care and minimized to what the reporting needs. We hold no special-category data, no compensation, and no performance ratings.

It is held in two forms. The current roster is refreshed by the daily sync and reflects the practice as it stands. Dated analysis snapshots record what the roster looked like on the day each was taken — this is what makes trends possible, and it means a person who has since left the practice may still appear in a historical snapshot as of that date, while being correctly absent from current views.

Sign-in credentials are separate from this. Account details exist to authenticate people into the tool and are not part of the Salesforce reporting data.

The data powers analysis and reporting for practice leadership — certification coverage, deployment readiness, and engagement trends. It is used inside Merkle for that purpose only. It is never sold, never used for advertising, and not disclosed to anyone outside Merkle for their own purposes.

It is, necessarily, processed by the vendors that run the service on Merkle's behalf: the application host, the managed database that stores it, and the email provider that delivers digests and links. They act only on instruction and only to operate the service — but naming them is more accurate than claiming the data never leaves Merkle's walls. Automated decision-making is not used: nothing here decides staffing, promotion or performance on its own. Every figure is a starting point for a human conversation.

Heavy per-run snapshots are pruned from analysis runs older than roughly one year, while the latest run per workspace and lightweight trend metrics are always kept. A compact person-level archive is retained for longitudinal analysis in place of the full snapshot.

Short-lived items are cleaned up on their own schedule: My Profile links expire within the hour and expired tokens are deleted; sync event logs are pruned after 90 days.

Every administrative and automated action is logged with attribution, filterable by category, and exportable. That includes self-service access: each request for a My Profile link is recorded, so there is a trail of who asked to see their own record and when. The daily email job writes a per-run heartbeat, so a missed run is visible rather than silent.

Trailblazer Scout uses no third-party analytics, advertising or tracking tools. No page sends the addresses you visit, what you search for, or anything you type to an outside analytics company.

To see which features are used, the app counts a few actions — applying a filter, exporting a file, importing a file — as plain totals, with no record of who took them. Sign-in times and administrative actions are kept in the audit trail described above.

On your device it keeps only what it needs to work: three cookies (your sign-in session, your My Profile link session, and your language), and in your browser's storage your preferences — light or dark theme, table column widths, notices you have dismissed — plus practice-level totals from analyses you ran, with no individual's details. None of it is used to track you or shared with anyone.

Operational sync notices are transactional. Leadership digests and lifecycle nudges are low-frequency and can be turned off in one click; addresses that hard-bounce or report spam are automatically suppressed from future sends. Sender identity is accurate and authenticated (SPF/DKIM/DMARC).

To ask a question about your data, or to exercise a data right, contact john.khuu@merkle.com. Trailblazer Scout operates within Merkle's corporate data-protection governance; refer to Merkle's corporate privacy policy for lawful basis, data-subject rights, and how they are exercised.