Features
Your people will not tap “I can’t be myself here” on an employer’s system if the promise of anonymity rests on our word. HABLA is built so that you, your IT people, and your union can check the promise instead of believing it.
HABLA has not launched yet, and these marks are honest. “Built” means implemented, tested, and verifiable in the repository today; “In build” means the schema and the contract exist and the interface does not; “Planned” means specified and scheduled, and nothing more. What is already built is precisely the guarantees in the IT, legal, and union section — the opposite of how software is usually sold, and deliberately so.
The demonstration
This is a leader’s console over an invented organisation. Group, filter, shorten the window, raise the floor: every figure is computed here, in your browser, with the same rules the product uses. Nine people work at the clinic. See what the system will hand you about them.
Illustrative figures, from an invented organisation. Not any customer’s numbers.
| Topic | Taps |
|---|---|
| I can’t sleep | 166 |
| Money is tight at home | 139 |
| Someone I love died | 79 |
| I’m being picked on | 101 |
| I feel alone here | 144 |
| I’m drinking or using more | No figure |
| I can’t be myself here | No figure |
An empty cell may be a zero or a withheld figure. The system does not tell them apart, deliberately: if it did, an empty cell would tell you that between one and nine taps are in it — which is exactly the figure the floor exists not to hand over.
The withheld count describes this cut and this window, never your filters. Filter to a single topic and watch the number not move: a counter that narrowed with the filter would be a yes-or-no test for “does this topic have between one and nine taps”.
No crisis topic appears here, and none ever will: those taps are recorded on no plane. They are not withheld — they were never written. Filter to one and the system refuses, because an empty answer would already tell you the topic exists and sits below the floor.
5 rows shown · 6 cells withheld
What someone sees after scanning a code — someone who is not going to create an account and may not have thirty seconds.
Content ships as an audience pack: what a high-school student reads is not what a night-shift operator reads. No pack publishes without the name of the clinician who reviewed it, and that review has not happened yet.
Why it matters
Your last vendor’s wellbeing content was ignored because it was written for nobody in particular. What lands is the specific line: “I translate for my family”, “I’m told to man up”, “I’m scared someone in my house will be taken”.
In build
Topics are tap targets in plain language, with a five-option mood check. Never a clinical form and never a 1-to-10 scale.
Why it matters
A person in distress will not fill in an instrument, and the moment you make them do it you have selected for the people who were already fine.
In build
The person gets sentences written to be sent as they are — to a teacher, a supervisor, their mother.
Why it matters
Knowing you need help and not having the words is the actual blocker, and no dashboard has ever fixed it.
In build
One tap copies the sentence to the clipboard.
Why it matters
That is the product’s moment of value, and every step between the sentence and the send is a person who does not send it.
In build
The beliefs that stop people asking, answered by conceding the objection and then solving it operationally.
Why it matters
“Everybody here knows everybody” is true at your site, and reassurance that solves nothing is worse than saying nothing.
In build
Specified: a guided timer for someone who cannot read anything yet.
Why it matters
Sometimes the useful thing is ninety seconds, not a referral.
Planned
Specified: who at your organisation a person can go to, described in their language, with the action type you configure — in person, form, call, or text.
Why it matters
“Talk to someone” is not a plan. A name and a door is.
Planned
Only if the person chooses, the request goes to the recipient you configured, encrypted, on a separate database. Never into a dashboard or a count.
Why it matters
This is the one place identifying information exists, it is the one place it belongs, and your leadership does not see it either.
In build
A crisis-flagged tap writes no row on any plane, and the server returns the same status code as an ordinary tap, so a network observer cannot tell them apart. An unknown chip is treated as crisis — it fails closed. The interstitial that interrupts and shows 988, Crisis Text Line and your configured local resources is still in build.
Why it matters
It is the tap that matters most and the one you will have no data about. That trade is what makes the other taps happen.
Built
Spanish is the structural default, not a locale file: a monolingual string does not compile.
Why it matters
A native speaker knows in one line whether a machine wrote it, and closes the tab.
Built
There is no login, no account, no cookie wall, and nothing that survives a page load.
Why it matters
An account is a list of who used it, and a list of who used it is the thing that ends this.
Built
An honest aggregate picture, with what you cannot see made as visible as what you can.
Specified: which topics weigh most, by audience and by site, as sums of whole reporting periods.
Why it matters
You are guessing right now, and the guess is usually wrong in a specific direction — see the language split.
Planned
Specified: how the topics move from one reporting period to the next.
Why it matters
It is the only honest way to answer “did the thing we spent money on do anything”.
Planned
Specified: site against site, at the grain the privacy floor can protect.
Why it matters
The break room at one plant is not the break room at the other, and you already suspect which one.
Planned
Specified: the share of taps in each language. In the demonstration data it is the cut that discloses fully — nothing is withheld from it.
Why it matters
It is the number that changes a staffing decision, and it is almost always a surprise.
Planned
Specified: the board export is a written narrative over already-suppressed aggregates, not a CSV.
Why it matters
There is no raw path to build a CSV on, and a brief is what a board can actually read anyway.
Planned
Six lines stating plainly what the dashboard cannot show, generated from the same constants that enforce them: removing a restriction removes its line, instead of leaving a promise the code stopped keeping.
Why it matters
It is the first thing a skeptical employee looks for, and it is the reason they participate.
Built
A withheld result comes back as a typed refusal the interface is required to handle; rendering it as zero means deliberately ignoring the discriminant.
Why it matters
A zero silently converts “we withheld this to protect six people” into “nobody tapped this”, and you would make a decision on it.
Built
Specified: verified poster placement per site, supervisors briefed, new hires oriented, badges distributed.
Why it matters
You will be asked to prove uptake to a board, and this is the part that is real, honestly countable, and costs nothing. The alternative is a completion list, and we do not build that.
Planned
You configure your minimum group size (upward only), your local crisis resources (additions only), your referral recipients, your routing, and your packs.
Why it matters
The guarantees are yours to tighten and nobody’s to loosen, including ours.
In build
The guarantees, and where each one is enforced. This is the section to forward.
Anonymous data and identifying data live in separate instances with separate credentials: no foreign key, no shared identifier, no service holding both. The build fails if one file imports both.
Why it matters
The standard is that somebody with full read access to both databases still cannot join them. That is the question your IT director will ask in the second meeting.
Built
An event row carries exactly six fields — organisation, site, audience pack, topic, hour, language — and the hour truncation is a column default, not a helper somebody can forget. No session, no device, no IP, no ordering, no primary key.
Why it matters
Two taps by one person must be indistinguishable from two taps by two people. If they can be told apart, the schema is wrong.
Built
The minimum group size is ten and it is applied inside the query, so a small group never crosses the process boundary. It is raised per organisation, never lowered, and the database rejects a lower value even if it is set by hand.
Why it matters
A campus with six counselors, a shift with eight custodians, a department with four people: those are the people who most need this to be true, and the only ones a floor protects.
Built
Every figure is a sum of whole reporting-period cells, and whether a cell is included depends on that cell alone — never on who asked, their filters, or their window. The withheld mass is protected too, not only the withheld cells.
Why it matters
A floor stops a small group being returned; it does not stop one being computed by subtracting two legitimate reports, which anyone with a browser can do by accident.
Built
Cuts that could re-identify are refused and say so. The refusal reads the effective dimension set, so moving a dimension into a filter reaches nothing new, and a filter counts against the ceiling.
Why it matters
A silently rolled-up answer looks like the answer you asked for, and that is worse than being told no.
Built
The public experience collects no free text on the anonymous plane, at all. Free text exists only on the contact side, only when someone deliberately asked for contact, and it goes only to the recipient.
Why it matters
One sentence identifies a person and two identify their manager. There is no anonymisation technique that survives a small organisation.
Built
One function is the only read path: there is no raw query interface, no export, no admin mode, and no second function for support. The build fails if one appears.
Why it matters
Every product like this has a back door labelled “for power users”, and this is the one commitment that cannot be honoured by policy.
Built
A crisis-flagged tap writes zero rows on every plane, and the server returns the same status code as an ordinary tap so a network observer cannot tell them apart. Crisis resources are configurable, but can never be removed or hidden.
Why it matters
Leaders never see crisis counts, and that is the trade: a number on a dashboard is worth less than one person’s belief that tapping it was safe.
Built
Contact-plane submissions are encrypted at rest, with a retention period set in your contract and a scheduled purge. There is no code path that creates a submission without a retention period being named.
Why it matters
“We keep it as long as necessary” is the answer that fails a union review.
Built
The mandatory-reporter disclosure appears at the point of submission, before the person types anything, in their language. The wording is configurable per jurisdiction and cannot be disabled.
Why it matters
A person who learns afterwards that an adult was required to act will never use it again, and neither will anyone they tell.
In build
There is no fee per contact, per booking, per conversion or per patient anywhere in the system. Provider listings are a flat annual fee that does not vary with volume or outcome, and no such field exists to be populated.
Why it matters
The incentive to route someone toward a paying provider is the thing that would quietly corrupt every other guarantee on this page. That is a legal boundary, not a preference.
Built
The product does not support mandated completion or tracking who finished, and it will not be built on request. What it does support is awareness compliance.
Why it matters
Mandating converts help-seeking into compliance, and enforcing it requires a completion list — which destroys the promise whether or not the lists are technically joinable.
Built
No analytics, no session replay, no advertising pixel, no third-party font, no error tracking on public routes. The build fails on an analytics import or on an unused dependency, and the content-security policy allows the site’s own origin only.
Why it matters
Your IT people can verify this from outside in about a minute, which is the point.
Built
HABLA is not a screener, a diagnostic, treatment, or triage: no feature evaluates a person’s risk or infers a condition from what they tapped. AI is permitted only for translation assistance with human review, taxonomy suggestions we approve, narrative over already-suppressed aggregates, and reading-level adaptation.
Why it matters
The moment a system scores a person, it becomes a record about them — and a record about them is discoverable.
Built
Two answers taken from different grids — topic×language and topic×site — each disclose their marginal minus their own withheld mass; subtracting them gives the difference of two protected masses, so no individual cell is exposed and the difference can still be small. The closure — a fixed catalogue of canonical cuts instead of an open query surface — is scheduled.
Why it matters
A privacy control whose limits are unwritten ends up trusted past them, and we would rather your union representative read it here than find it themselves.
Built
A poster in a bathroom stall reaches someone no email will.
Specified: the code carries organisation, site and audience pack, and nothing finer. No per-poster identifier and no campaign parameters.
Why it matters
“Which poster is working?” is a reasonable question, and a per-poster id narrows a tap to one corridor — which at a campus with six counselors is a person. Placement is measured at site level, which you already have.
Planned
Specified: posters, stickers, badge cards and print-ready PDFs, per site and per audience, bilingual, with Spanish-only variants for the sites that need them.
Why it matters
This is the distribution channel, not a leave-behind. And Spanish set smaller than the English says exactly what it looks like it says.
Planned
Specified: a placement guide for bathroom stalls, break rooms, bus barns, cafeterias and locker rooms.
Why it matters
The poster has to work for someone who does not want to be seen reading it. That is the design constraint, not an afterthought.
Planned
No app store, no download, no account, no cookie wall.
Why it matters
Every install step is one more chance to be seen deciding.
Built
Specified: a blocking performance budget — largest contentful paint under 2.0s on simulated 3G with a mid-range Android profile — and offline operation after the first load.
Why it matters
The people this is for are not on new phones on good wifi, and a spinner is a closed tab.
Planned
Specified: the contact request goes by text or email to the recipient you configured, in the person’s language, with a warmly written acknowledgement and an escalation timer that the acknowledgement cancels.
Why it matters
The failure that ends a pilot is not a leak, it is a person who asked for help and nobody came.
Planned
The limits
These three get asked for regularly, always for a good reason. The answer is no, and it is better to know that before signing.
Forward it in pieces: “For your people” to whoever handles communications, “For you” to leadership and HR, and “For your IT, legal, and union” to whoever does the review. The page is grouped that way for that reason.