You’re right to be skeptical. Here’s exactly how your words are protected.

Raw text has a defined deletion boundary.

Raw text exists in unsubmitted drafts, which report generation does not clear, and whenever a failed processing attempt must be retried. After Anthropic successfully rewords a submitted row through Vercel AI Gateway, Forum 360 stores the paraphrase and clears that row's raw field in the same database update. The report pipeline does not use a paraphrase unless that clear is confirmed.

The data flow, step by step.

1. You type your answer. During the open cycle, authenticated app routes let you save, read, and revise your own draft. Other members and chairs do not get a raw-answer reader.
2. Anthropic rewords it. A privileged server worker sends submitted raw text through Vercel AI Gateway to Anthropic to produce a paraphrase. Direct browser database roles cannot read those raw columns.
3. Successful rows are cleared. Once a paraphrase succeeds, Forum 360 stores it and clears that row’s raw text in one database update. A failed attempt keeps the raw text for retry and out of that report run.
4. Thresholded with 3+ reviewers. A category is used only after at least three distinct reviewers contribute safe feedback. Reports may include selected reworded excerpts from that eligible pool.
5. The report is written. Anthropic drafts reports through Vercel AI Gateway from stored paraphrases, scores, and aggregate context. Released reports never expose the raw-answer columns.

Raw text is cleared after successful rewording.

While a cycle is open, your original answers remain so you can edit them. For each submitted answer, the report worker first obtains an Anthropic paraphrase through Vercel AI Gateway, then stores that paraphrase and clears the raw field in one database update. If either step fails, the raw text remains for retry and that row is excluded from the report run. Reports are finalized only from eligible, successfully processed inputs. Permanent size failures are quarantined for author-only correction before release; their protected originals remain and the affected rows are excluded.

The rewording strips your fingerprint.

The people in your forum have read your emails for a decade. Writing style is a fingerprint. So before anyone sees anything, an AI rewrites every comment from scratch. Reports are assembled from these paraphrases only, never from anything you typed.

The AI processing boundary is explicit.

Forum 360 sends every AI request through Vercel AI Gateway to Anthropic, the current inference host. Those requests can include draft text used for optional follow-up questions, raw submitted answers and answered follow-ups used to make paraphrases, and the paraphrases, scores, and aggregate context used for report-writing. Forum 360 does not use answers to train its own models. The separate email, optional SMS, analytics, and billing integrations do not receive feedback or report content.

Browser access is limited at the database layer.

Column-level grants prevent signed-in browser database roles from selecting raw or per-giver paraphrased comment fields. Authenticated server routes can return a member’s own draft for editing, and the privileged generation worker can process submitted raw text. Those server paths are separate from chair and peer access: the person running the cycle sees completion status, not members’ answers.

Too few voices, and peer feedback stays suppressed.

If fewer than 3 members review someone, we show an insufficient-feedback notice rather than a personal feedback report. Reports use paraphrases and group context without giver names, and the threshold reduces the chance that one person’s contribution can be isolated. It cannot make a distinctive fact or long-held viewpoint unrecognizable to people who already know the room.