Security and privacy
Objective. Hold the hardest line in the Academy: lead with honest value and the design posture the demos support, and route every specific security, privacy, residency and compliance question to a specialist - because this is the topic most likely to over-claim and most damaging when it does.
Security and privacy are where deals get blocked and where a single invented claim can end an account or create legal exposure. This module is deliberately strict: it teaches the small set of things that are safe to say, and the large set that always escalates, with no exceptions.
See it in the demo
What security and privacy mean in Time Champ terms
Because the platform measures people, two legitimate fears appear immediately (F04): employees fear surveillance, and IT and data-protection fear uncontrolled capture, storage and access. The product's design posture answers these in ways the demos actually show: capture is policy-driven and mode-based rather than all-or-nothing; classifications are reviewable; privacy and data-source settings are visible rather than hidden; and access is scoped by role and organisation position (PLAT-03, F05). Employee Monitoring treats employee communication as part of setup.
That is the honest ceiling of what you can assert: the product is BUILT WITH capture boundaries, reviewable classifications, visible privacy settings and role-scoped access. It is a design posture, demonstrable in the demos. It is not, by itself, a set of security guarantees - and the distinction is the whole module.
What a Sales or CSM person can say confidently
Safe to say: 'Capture is policy-driven - you decide what is collected and for which roles - and access is scoped by role and org position, so it is not a free-for-all.' (F04 talk track.)
Safe to say: 'A flag here is a prompt to investigate, not a verdict; a non-productive label is not proof someone did no useful work.' This protects both employee trust and the credibility of every number.
Safe to say: 'Employee communication is part of honest setup' - and to treat a request for covert monitoring as a red flag to decline and escalate, not to enable.
Safe to say, always: 'For the precise security answer, I will bring in our specialist so we commit to exactly what is true for your environment.'
Do not assert - under any framing, urgency or seniority of the asker - encryption, retention, residency, certifications, sub-processors, breach history, penetration-test results, or legal basis. Not even approximately.
What always escalates to security or product
Everything specific. Route to a specialist, every time:
- Encryption (at rest, in transit), key management.
- Data retention and deletion.
- Data residency and hosting location.
- Certifications and attestations - never name, confirm or imply one.
- Sub-processors and vendor personnel access.
- Breach history, incident response, penetration testing, vulnerability management.
- Legal basis for processing, data-subject rights handling, works-council and regional labour-law positions.
- Any item in a security questionnaire, DPA or RFP security section.
There is no 'safe approximation' here. An invented certification or an approximate residency claim is a false statement that a security review will catch and that can carry legal consequences. 'I will get you the precise answer' is the only acceptable response to a specific security question you have not verified.
The honest limit
Demo-supported: a design posture - policy-driven capture, reviewable classifications, visible privacy/data-source settings, role-scoped access, and employee communication as part of setup.
Confirm with product/security, always: encryption, retention, residency, certifications, sub-processors, breach and incident posture, penetration testing, legal basis, and every security-questionnaire or DPA item.
Separate cleanly and ruthlessly: 'the product is built with capture boundaries and role-scoped access' (safe, demo-supported) from any specific security, privacy, residency or compliance commitment (specialist-owned). If you are unsure which side a question is on, treat it as specialist-owned.
Interpretation check
The demos show a design posture (policy-driven capture, reviewable classifications, visible privacy settings, role-scoped access); they do not establish any specific security or compliance guarantee. Every encryption, retention, residency, certification and legal-basis question is a product/security confirmation, with no safe approximation.
In the field
BFSI and works-council-sensitive geographies make security and privacy the gating issue; the winning posture - also the right one for a contact-centre account like OVO - is to lead with work and output value, treat employee communication and access scope as first-class, and route every residency, retention and legal-basis question to a specialist.
Practical task
Write a one-page security-and-privacy brief for a prospect's InfoSec and operations leads: the design posture you can state (with the demo evidence), the one interpretation rule about labels, and an explicit, complete list of the questions you will route to a specialist rather than answer. The escalation list should be longer than the claims list.
Self-check
An InfoSec lead asks exactly what is captured, where it is stored, and whether you hold a specific certification. What do you do?
Describe the honest design posture (policy/mode-driven capture, role-scoped access), then route storage/residency, certification and every specific control to a specialist - and never name or imply a certification you have not verified.
Why is there no 'safe approximation' on a residency or certification question?
Because an approximate or invented security claim is a false statement that a security review will catch and that can carry legal and contractual consequences, so the only acceptable answer is the precise one from a specialist.
A customer asks to monitor employees without telling them. How do you handle it?
Treat it as a red flag: employee communication is part of honest setup and often legally required; decline to position covert monitoring and escalate rather than enabling it.
Which security claims are demo-supported and which are specialist-owned?
Demo-supported: policy-driven capture, reviewable classifications, visible privacy/data-source settings, role-scoped access, employee communication in setup. Specialist-owned: encryption, retention, residency, certifications, sub-processors, breach/incident posture, penetration testing and legal basis.
Verified vs demo. Policy-driven capture, reviewable classifications, visible privacy/data-source settings, role-scoped access and employee communication in setup are shown in the demos; encryption, retention, residency, certifications, sub-processors, incident posture and legal basis are product/security facts that must never be asserted.