SMB SaaS Responsive web Three-sided product Solo, end to end

Brio

Employee wellbeing for companies with no HR team, where the privacy boundary is not a policy page. It is the architecture.

My role
Product design end to end: research, personas, journey, architecture, prototype, voice
Primary user
Priya, the person handed people work with no HR training
Built
47 screens, 99 state pages, 100 files, every internal link resolving
Stage
6 of 12 stages complete, through Voice
01 The problem

Three users, and only one of them is the buyer.

In a company of forty people there is no HR department. There is an office manager, an ops lead or a founder who got handed people work on top of their actual job. She knows everyone by name and knows none of the methodology. She is the buyer, the daily driver, and the point where adoption succeeds or dies.

Behind her, the owner pays and wants proof it is worth it. In front of her, the employees answer, or do not. The person whose behaviour decides whether the product has any data at all is the one person who never sees the dashboard and never signs the invoice.

02 The trust gate

In a team of twelve, “anonymous” is not a believable word.

The lowest point of the current-state journey is not onboarding friction or price. It is the moment an employee reads the words “your answers are anonymous” in a company small enough that everyone can be identified by their writing style, their absence, or the timing of their response.

And in a small business there is no HR layer standing between the boss and personal data. The structural protection that exists in a large company is not there. So the privacy promise cannot be a sentence in a policy nobody opens. It has to be a mechanism the employee can see, and it has to visibly constrain what the boss is able to see.

Privacy as mechanism, not marketing. If you cannot point at it in the interface, it is not a promise.
03 The move

Four mechanisms, working as one bundle.

The privacy bundle is the load-bearing feature of the product. It is four things that only work together, and removing any one of them collapses the trust the other three were building.

A disclosure shown before the first question, not buried in a footer. A minimum of five responses before any aggregate is ever rendered. No live response count anywhere, because a running tally in a small team is a countdown to identification. And the privacy model stated as a fact about how the product works, in plain words, in the product itself.

WHAT THE OWNER AND OPERATOR SEE Team pulse, aggregate only READ, ALWAYS ATTACHED TO THE NUMBER “Down from last month. Workload is the driver.” “Next: shorten the check-in to one question.” HARD BOUNDARY · MINIMUM OF 5 · NO LIVE COUNT WHAT NEVER CROSSES Response Response Response Response Response Response Response Response Response Response No name, no timestamp trail, no per-person view, no export. Not restricted by permission. Absent from the model.
The boundary drawn as architecture. Individual answers exist below the line and have no representation above it. This is not a permission setting that an admin could later loosen; there is no screen, no export and no entity that would let a boss look at one person.
04 Screens

The promise, as the product renders it.

Three frames from the grey clickable prototype: 47 screens and 99 state pages, every state its own page. Concept is in progress, so nothing here is coloured yet. The privacy argument is made by what these screens refuse to show, which is a structural claim and readable at this layer.

Brio dashboard: a team pulse reading Steady with one suggested next step, a weekly participation figure of 72 percent, and a note stating that answers are aggregate only.
Grey prototype. The operator opens on a word, not a chart. One suggested next step sits under it, and the privacy line is on the same screen as the number rather than in a settings page nobody reads.
Brio check-in question: one question asking how work has felt this week with three answers, above a note that the answer joins a team aggregate and is never shown alone.
Grey prototype. The employee side is one question and three answers. The sentence under the button tells them what happens to it, which is the only reason a second check-in ever arrives.
Brio team pulse detail: a score of 7.4 out of 10 with the previous cycle for comparison, a trend chart over recent cycles, and a participation panel with a minimum answer threshold.
Grey prototype. The detail view holds a threshold: no score is shown until five people have answered, and there is no live count, because a number drawn from three people is how a small team gets identified.
05 Decisions on record

Calls that cost something, made on purpose.

D1

Minimum of five, even when it means showing nothing.

A team of six with four responses sees an empty state, not a number. This is expensive: it delays the first moment of value, which is the exact moment activation is usually won. It is kept because a product that quietly renders an aggregate from three answers has already broken the promise it is selling.

D2

No live response count, anywhere.

“7 of 12 answered” is a standard, useful, motivating pattern. In a twelve-person company it is also a way to work out who has not replied yet. The pattern is removed from the product, and the word “live count” is in the forbidden list of the voice rulebook so it cannot quietly return in a later feature.

D3

A number never appears without its reading.

The operator is not an analyst and does not want to become one. Every score ships with a plain-language interpretation and a suggested next action, as a voice rule enforced across all ninety-nine screens rather than a nice touch on the dashboard.

D4

A dip is called a dip.

No celebration states, no exclamation marks, no “successfully”, no encouragement. The entire competitor set writes in the same upbeat wellbeing register, which is why plain and honest is the differentiation. If the trend is down, the product says so, and then says what to do.

06 Still open

The number that decides whether any of this worked.

[?] Does the privacy bundle actually move participation above sixty-five percent. That threshold is where the aggregate stops being noise and starts being signal. Every mechanism above is designed to reach it, and none of them proves it. It is closed by the first live test, not by a better argument.

[?] Whether a self-serve, aggregate-only tool reads as real value to an owner. The owner is paying for something he can never drill into. That is the commercial risk the whole model carries, and it is written at the top of the canvas rather than left implied.

07 Artifacts

Forty-seven screens, ninety-nine states, one voice.

The prototype covers the whole product across all three audiences, with every state as its own page and every internal link resolving. The voice rulebook was then applied line by line across all ninety-nine screens as a text-only pass, with the before and after of every string recorded.

Next case

Sift