The question came from a VP of engineering, about forty minutes into a call that had been going well. He liked the product, his managers liked the product, and then he leaned back and asked the thing everyone eventually asks. “So if I buy this for two hundred people, what do I get to see?” I told him the honest answer. Nothing. He laughed, then realized I wasn't joking.
“You want me to pay per seat,” he said, “and I can't open it and look at what my own team is doing in there.” Correct. “That's insane.” Also, I'd argue, the entire point. But it's the most reasonable thing a person with a budget can say, so it deserves a real answer.
Almost everything you buy for a team, you buy so you can look inside it. This is the one thing you buy so that you can't.
Every other tool in your stack sells you visibility. The project tracker shows every ticket, the HR platform shows every rating and every note a manager ever wrote. You pay, you get a dashboard, the dashboard ranks who's ahead and who's behind. So when a career tool says the admin sees none of that, the reflex is that something must be broken or hidden.
Nothing is hidden. We made it impossible for a company to read an individual's record, and we did it in the database itself, not in a promise you have to trust. No manager view of someone's entries, no readiness score to sort your team by, no screen that turns your people into a leaderboard. Not because we forgot to build it, but because building it would quietly destroy the thing you came to buy.
The moment this becomes something your boss can read, it becomes something you lie in.
The tool only works if people are honest in it: logging the migration that went sideways, the rubric row with nothing under it yet, the sponsor who has gone quiet. Give a manager a window into all of that and nobody writes down a real gap again. You'd log the wins, dress them up, leave the mess out, and within a month the company would be paying for cheerful, tidy performance theater instead of a true picture.
So the privacy isn't a concession to nervous employees. It's the wall that makes the data worth having, and it's load bearing. Take it out and you're left with a more expensive version of the brag doc everyone already fakes.
Fine, he said. Then tell me what I'm buying, because it clearly isn't visibility.
Three things, none of which need you to see your people. First, they stay. Nobody quits because their record is too tidy. They quit because the path to the next level feels stalled and invisible, and one day someone else offers them clarity and a title. A tool that maps their real ladder and shows forward motion makes the next level feel reachable, and one strong engineer not leaving pays for a lot of seats.
Second, review season stops being a fire drill. Instead of committees reconstructing a year from memory and managers writing packets from a blank page, people arrive with work that is already dated and linked to the real pull request. The argument about what happened just ends, and the time goes to the decision instead of the archaeology.
Third, and quieter, it is a signal about what kind of place you are. “Everyone here gets a private career system that belongs to them” recruits people. “We monitor productivity” leaks out of exit interviews. Funding a benefit you are forbidden from reading says you invest in people's craft rather than watch them work.
But they take it with them when they leave. So what did I pay for?
The years they were here doing sharper, better documented work, and the reviews that were easier because of it. The part that stings, that they keep it, is the exact reason it worked while they stayed. A record you can confiscate is one nobody is ever honest in, and its being theirs is what earns the honesty that created the value in the first place.
What you actually administer is capability, not content: seats, licenses, a verified domain so new hires join automatically, onboarding, support. The only reporting you get back is aggregate and anonymized, and even that stays hidden until at least five people are on it. It sits beside your Lattice or Workday rather than replacing it. Those hold the review; this holds the evidence that feeds it, so people stop showing up to your performance software with an empty box and a panic.
How would I even know it's working, he asked, if I can't see anything?
Two numbers, neither needing a private word. Ask your team how many hours the last review cycle cost them, then ask again two cycles later and watch it fall. And see whether the people who used it are still here at renewal. If neither moved, don't renew. We would rather you measure it than take our word.
He didn't sign that day. He signed a few weeks later, once the shape of it stopped looking like a bug. Because past the reflex, the paradox isn't one. You are not buying a window into your people. You are buying them a reason to stay and a review season that doesn't fall apart, and the price of both is that you never get to look.
The fact that you can't read it isn't the catch. It's the whole reason it works.