Case study
Safespace
Two-way anonymous reporting software for workplaces, schools and communities, taken from a blank page to a working product. I designed and built the full product: the brand identity, product site, reporting experience, case dashboard and data layer underneath.
The problem
Problems rarely start big. They start unsaid. The people closest to an issue usually notice it first, but most reporting channels either ask them to put their name to it or send their words into a form that never answers.
Safespace makes reporting anonymous and two-way. The organisation can ask follow-up questions and share outcomes, and nobody’s identity is collected along the way.
Identity
A lowercase wordmark set in Fraunces and finished with a green full stop, on a calm palette of aubergine, paper and mint. Coral is kept for urgent states only, so it means something when it appears. Figtree carries the interface and Geist Mono handles case numbers, timestamps and figures.
- Paper#FAF8F4
- Mint#C8EEDB
- Spring#5FE08F
- Lilac#D8CCFA
- Aubergine#2D1E3D
- Coral#FF7559
Three views
One product, three audiences: the buyer, the person speaking up and the team responding. Each one can be tried in the walkthrough, which runs on sample data for a sample organisation.
- (opens in a new tab)
Product site
Explains the idea in plain language to the people who would buy it. Every section has its own address, such as /how-it-works, which updates as you scroll so any part of the page can be shared.
(opens in a new tab)Employee view
Where someone speaks up. No account and no name: they describe what happened, add a file if they want and receive a private case key. The key is the only way back into the conversation, and only a hash of it is ever stored.
(opens in a new tab)Dashboard
Where the case team works. Replies arrive live, cases are prioritised, noted, referred on and closed, and a reporter is only ever asked to share who they are if they choose to. Board reports export in a few clicks.
Built for trust
Anonymity can’t depend on the interface behaving. The safeguards live in the database and on the server, where they hold even if a screen gets something wrong.
- Row-level security
- Every table is locked down in Postgres, so staff can only read cases from their own organisation, whatever the interface does.
- Hashed case keys
- Keys are 16 characters from an alphabet with no lookalike letters and are hashed with a server-side secret before they reach the database.
- Content-free alerts
- Email alerts say that a case needs attention, never what it says. Messages can only be read on the dashboard.
- Rate limiting
- Submissions are throttled by a Postgres function, so the reporting page can stay open to anyone without being flooded.
- Walkthrough mode
- The public walkthrough runs on an in-memory copy of a sample organisation. Nothing is saved or emailed and app routes are kept out of search engines.