Designing a Privacy-First Architecture for Sensitive Data: Zero-IP Logging, Postgres RLS, and AI Safety

Victor Vieira, CTO and co-founder of Sigilo Profissional, detailed a privacy-first architecture for the B2B workplace-survey and whistleblowing platform, combining PostgreSQL row-level security with application-level tenant isolation, zero-IP logging, and protocol-token access for anonymous reporting. The system uses large language models to help employees structure reports and summarize eNPS sentiment while stripping PII before any data reaches external AI models, and it maintains immutable, cryptographically hashed audit logs for ISO 37002 compliance.

When building software that handles sensitive human data like workplace feedback, satisfaction surveys, and compliance reports , security and privacy cannot be treated as optional features or mere legal disclaimers. They must be embedded into the core system design. At Sigilo Profissional sigiloprofissional.com.br https://sigiloprofissional.com.br , a B2B SaaS platform focused on Workplace Climate Surveys, eNPS, and Whistleblowing Channels compliant with ISO 37002 and GDPR / LGPD , privacy is the fundamental prerequisite for psychological safety. If employees do not trust the platform's anonymity, engagement drops to zero. Here is a breakdown of the security architecture and privacy controls we implemented in our Python FastAPI and PostgreSQL stack. To prevent cross-tenant data leakage, we enforce tenant isolation at two independent layers: firm id within SQLAlchemy. SET LOCAL app.firm id per database session. -- Enforcing PostgreSQL Row Level Security RLS ALTER TABLE tenant complaints ENABLE ROW LEVEL SECURITY; CREATE POLICY firm isolation ON tenant complaints USING firm id = current setting 'app.firm id' ::uuid ; Why both? Even if a bug or missing filter occurs in application code, the database engine natively blocks access to data outside the active tenant context. To ensure complete whistleblower anonymity: X-Forwarded-For and client IP headers. No IP addresses are saved in NGINX logs, application memory, or database records. SGL-2026-7X3K . Whistleblowers can check updates using their protocol token without ever creating an account or storing session cookies. We use Large Language Models LLMs to assist employees in structuring clear reports and to summarize qualitative eNPS sentiment for management. To prevent sensitive Personally Identifiable Information PII from being sent to external AI models: Compliance frameworks such as ISO 37002 require full auditability for compliance officers. We maintain immutable audit logs for administrative actions e.g., status updates, report triage using cryptographic hashing, ensuring complete transparency without compromising whistleblower anonymity. As we continue scaling our engineering stack, we are reviewing our security roadmap. We would love feedback from the Dev.to community: Looking forward to your thoughts and suggestions in the comments Victor Vieira | CTO & Co-founder @ Sigilo Profissional https://sigiloprofissional.com.br 🔗 LinkedIn: Victor Vieira https://www.linkedin.com/in/victorbvieira/