Your retro is sensitive data
2026-10-02 · The Scrums team
October is Cybersecurity Awareness Month. Here's a question it rarely asks: where does your team's most honest feedback end up?
October is Cybersecurity Awareness Month, as it has been every year since 2004. Most of its advice is about passwords, phishing and updates, and all of it is worth taking. Here's a question it rarely asks: where does your team's most honest feedback end up?
A retro board holds some of the most candid things people write at work: what's frustrating them, what isn't working, sometimes who. That candour is the point of a retro. It's also why the board deserves the care you'd give any other sensitive data.
Four questions to ask of any retro tool
- Can anyone read the cards while they're being written? If people can see each other's cards as they type, they write less.
- Who can find out who wrote what? Anonymity that someone can switch off later isn't anonymity.
- Where does the text go? Some tools send cards to outside AI services to group or summarize them.
- What else runs on the page? Analytics, ad trackers and other companies' scripts run with access to whatever is on the screen.
How Scrums answers them
- While people write, other people's cards are face-down, and neither their words nor their authors leave our server until the facilitator reveals them. Retros are anonymous by default, and once anyone has written a card, that can't be switched off.
- Health checks never show who rated what, and the same lock applies: once anyone has rated, the check stays anonymous.
- Auto-group clusters similar cards on our own server. No outside AI service ever sees them.
- Inside the app, where your team's words are, pages load scripts, styles and fonts only from scru.ms: no ad trackers, no outside analytics, nothing from other companies. Our public pages, like this blog, use Google Analytics so we can see which pages people find useful. It never runs once you're signed in, and never if your browser sends Global Privacy Control or Do Not Track.
- Calls run through our own voice service, and video recordings on pages are kept with the page, never sent to an outside service.
To find and fix problems, we record how pages are used, with our own software. Anything typed into a field is masked in your browser before it's sent, recordings are deleted after three days, and browsers that send Global Privacy Control or Do Not Track aren't recorded at all. The Privacy Policy has the details.
Security is mostly habits, and this month is a good time to check yours. Start with where your team's candour lives. See how a Scrums retro works, no account needed.