Cadence Signal

The comparison that makes it work

Most wellbeing tooling compares a person to a population. It reports that Maria is in the 80th percentile for after-hours activity, and a manager quite reasonably concludes that Maria is a hard worker. The information that matters — that Maria was in the 20th percentile until nine weeks ago — is invisible, because it was never the comparison being made.

Signal only ever makes the second comparison. Every figure it produces is movement relative to that individual’s own rolling 90-day median. A person whose working pattern has been stable for two years produces a flat line regardless of how that pattern compares to anyone else’s. A person whose pattern has changed produces a slope, and the slope is the product.

This has a consequence worth stating plainly: Signal cannot tell you who on your team is closest to burnout. It can tell you who has moved furthest from themselves. Those are different questions, and only the second one can be answered without either a clinician or a guess.

We did not invent this comparison and would rather not be credited with it. The occupational-health literature has argued for within-person baselines for years, on the grounds that population norms are a poor predictor at the level of the individual, and the personalised-modelling work on wearables reaches the same conclusion from the other direction. The idea is settled; what is missing is a product that holds to it when a customer asks for a league table. That request arrives in most evaluations, and declining it is the whole design.

Why an AI gateway is the best sensor you already own

Every serious organisation now routes model traffic through a proxy — LiteLLM, an Azure gateway, OpenRouter, something internal. It exists for cost control and audit. It also happens to sit in front of the single most behaviourally revealing tool your staff touch, and it is already logging metadata about every interaction.

Not the content. The shape:

• When. First session of the day, last session of the day, and how much of the distribution falls outside contracted hours.
• How long. Session duration and the gap structure between sessions, which distinguishes sustained focus from constant interruption.
• What kind. A task-type classifier running inside your proxy labels each session — building, debugging, explaining, drafting, reviewing. The labels leave the proxy; the text does not.
• How hard. Retry loops, escalating rephrasings, and abandoned threads. A rising ratio of “help me fix this” to “help me build this” over eight weeks is one of the clearest signals Signal tracks.

None of this is surveillance of what somebody said. It is the same class of metadata your gateway already retains for billing, read for a different purpose and with the person’s knowledge.

The value is in the sampling rate. A pulse survey gives you twelve data points a year per person, each one filtered through how that person felt on the morning they filled it in. Gateway telemetry gives you a continuous signal that nobody has to remember to produce. Neither is sufficient alone: the survey knows what the telemetry cannot see, and the telemetry covers the eleven months when nobody is surveying.

The objection, which is the right one

Everything in the paragraphs above is also the technical description of productivity surveillance with a wellbeing label on it. We are not going to argue that the distinction is obvious, because it is not, and the market has earned its suspicion: monitoring products already track which AI tools staff use and how often, sold on adoption and efficiency, and staff have noticed. The listening research keeps finding the same reflex: employees say they would rather talk to a chatbot about stress than use an employer mental-health benefit, because they do not trust who reads it. A product that reads gateway metadata is building on top of that distrust whether it acknowledges it or not.

So the difference has to be in what the system cannot do, not in what we promise not to do with it.

• No individual output metric exists. Signal computes no measure of volume, throughput, tokens, sessions completed or work produced, and exposes none — not to a manager, not to people operations, not through the MCP server, not in an export. The quantity a productivity dashboard would need is not withheld; it is not calculated.
• The direction of the signal is fixed. Every derived value moves against a person’s own earlier baseline and can only indicate strain. There is no reading of any instrument that says somebody is performing well, because the system has no notion of performing well.
• The individual reads it first. A person sees their own file — every score, every input, the formula, the history — and their manager sees a band only if that person has switched manager visibility on. Withdrawal is immediate and logged.
• We contract against the misuse. The licence prohibits using Signal output in performance review, compensation, promotion, redundancy selection or disciplinary process, and termination for breach is ours to exercise. It is a contractual remedy rather than a technical one, and we would rather state its limits than dress it up: it does not stop a determined employer, it makes the attempt expensive and documented.

If your intention is to find out who is producing least, this product will frustrate you, and the sales conversation is better spent discovering that early.

What the instruments actually are

Signal ships three self-report instruments and is explicit about their provenance, because this is an area where vendors are routinely vague.

The short pulse is ours: five to seven items, calibrated against the long-form results in your own organisation rather than against a published norm. It exists to keep a signal alive between the long instruments, not to replace them.

The long form is derived from the Copenhagen Burnout Inventory — a 15-item version across personal, work-related and client-related exhaustion, and a 20-item variant that separates a fourth sub-scale. CBI is published for free use, which is why it is the default.

The alternative long form is derived from the Oldenburg Burnout Inventory, 16 items across exhaustion and disengagement, for organisations that prefer its two-factor structure or already have historical OLBI data.

The Maslach Burnout Inventory is the most cited instrument in the field and is commercially licensed by its publisher. We do not redistribute it. If you hold a licence, Signal will score MBI responses alongside everything else; if you do not, we will not sell you one under another name.

Who sees what

The access model is the part most likely to decide whether this works in your organisation, so it is fixed rather than configurable.

The individual sees everything about themselves: every score, every input, the formula, and the history. There is no version of Signal in which an employee has less visibility into their own file than their manager does.

The line manager sees a risk band — green, amber, red — for direct reports who have switched manager visibility on, and nothing at all for those who have not. A person who withdraws consent disappears from the manager’s view immediately, and the withdrawal is logged. Non-consent is indistinguishable from having no direct reports in that position, by design.

People operations sees aggregates at team level and above, subject to small-group suppression. The system refuses queries whose answer could be reconstructed by subtracting two permitted aggregates, which is the attack that defeats most naive minimum-group-size rules.

Nobody sees prompt content, message text, 360 free-text comments, meeting titles, or anything resembling an emotional state. These are not collected, so there is no permission that grants access to them.

The regulatory position, stated once

Article 5(1)(f) of the EU AI Act has, since 2 February 2025, prohibited AI systems that infer emotions in the workplace; penalties have been enforceable since 2 August 2025. The tier is the highest one in the Act. Article 99(3) reads EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, and both limbs have to be quoted together, because above roughly EUR 500 million of turnover it is the percentage that binds and the EUR 35 million figure understates the exposure — for a group turning over EUR 50 billion, by two orders of magnitude.

The Commission’s guidelines, approved 4 February 2025 as C(2025) 884 final, settle two things. The first is where the boundary runs: the prohibition reaches emotion inferred from biometric data — Article 3(34), physical, physiological or behavioural characteristics — which finishes voice-stress, facial-expression, heart-rate-derived and keystroke-rhythm inference in EU workplaces, while inference from written text falls outside this particular prohibition. The second is the exception, and it is the one that decides what a burnout product is allowed to be: the medical exception does not cover general workplace monitoring of stress, burnout and depression, and the safety exception is confined to genuinely hazardous work — construction, transport, mining — rather than to corporate wellbeing.

Put those together and there is a consequence for this product that we would rather state ourselves than have your counsel find. Signal is not clinical care and employs no clinicians. That is ordinarily read as a limitation, and it is one — but it also means the medical exception was never available to us, so declining the clinical mode gives up nothing that was ever on offer. What follows is that the non-biometric architecture is not a design taste and not a position we could revisit under commercial pressure. It is the only configuration we will ship. There is no third option: a burnout tool that reads faces, voices, gaze, posture or physiological signal is prohibited outright, and “it is for employee wellbeing” does not rescue it. The distance between those two products, for the buyer who deploys one of them across a European workforce, is EUR 35 million or 7% of group turnover, whichever is higher.

One thing we give up voluntarily on top of that, and it is worth separating from the part the law compels. Signal performs no affect recognition of any kind — not the prohibited biometric sort, and not the permitted text sort either. The second half is our choice, not the law’s requirement. We make it because free-text inference is the feature works councils object to hardest, because the construct validity of the underlying measure is actively contested in the literature, and because a product whose legality turns on how a regulator reads our marketing copy is a poor thing to build a five-year deployment on.

Three qualifications on that, in the order a sceptical reader reaches them.

The step from “biometric” to “questionnaire” is ours, not the Commission’s. The guidelines address biometric data and expressly carve out written text. Self-report instruments are not mentioned in them at all. Our reading — that a fifteen-item questionnaire is not a physical, physiological or behavioural characteristic and therefore not biometric data — follows from the same limitation, but it is a vendor’s legal position supported by an annual independent attestation, and it will be written that way in anything we sign. It is not a quotation from a regulator, and a vendor who offers it to you as one is telling you something about their documents rather than about the law.

The exposure is statutory, not observed. No Article 5 enforcement action has been published anywhere in the Union as at March 2026, although investigations naming workplace emotion recognition have been reported. What the architecture removes is a configuration carrying the top fine tier — not a demonstrated outcome. A vendor selling you the aversion of a fine that has never once been levied is selling you a story, and we would rather you heard that distinction from us than construct it yourself in the third meeting.

Escaping Article 5 does not leave the system unregulated. Signal sits in Annex III point 4, employment and worker management, as high-risk. Those obligations were deferred — from 2 August 2026 to 2 December 2027 for standalone systems, and to 2 August 2028 for systems embedded in products — by the regulation adopted on 8 July 2026 after the Parliament vote of 16 June. What was not deferred: the Article 5 prohibitions, in force since February 2025; the Article 50 transparency duty, which did not move — content marking applies from 2 August 2026, with a four-month transition for systems already placed on the market; and the Article 4 AI-literacy duty. A deferral on one clock is routinely reported as relief on all of them, and it is not — it is eighteen further months in which a buyer expects the work to have been done.

Separately: screening data about exhaustion may constitute health data under GDPR Article 9 depending on how you deploy it. Signal ships a data-processing description and a per-field justification precisely so that your DPO and, where applicable, your works council can make that determination with the facts in front of them. In Germany, Austria and the Netherlands, plan for co-determination sign-off before rollout; the generated documentation is built for that conversation. Austria is the one that can end the conversation. ArbVG §96(1)(3) makes a control system touching human dignity subject to a works council consent that no conciliation board, arbitration panel or court may substitute — the contrast is §96a, which expressly permits substitution and leaves §96 untouched. An Austrian works council that will not agree to burnout screening ends Austrian deployment, full stop, and no quantity of documentation from us turns that no into a yes.

One note for deployments outside Europe, because generalising from it is the common error. Japan has no analogue of BetrVG §87(1)(6). Article 90(1) of the Labour Standards Act requires the employer to ask the opinion of the union or of a representative of the majority of workers when the rules of employment change, not to obtain their consent. A negative opinion does not prevent the rules taking effect, and Article 120 caps the penalty for skipping the step altogether at JPY 300,000. Corporate liability under the privacy statute is a fixed JPY 100 million ceiling and is not linked to turnover, so the percentage-of-turnover reasoning above has no Japanese footing at all. What we carry in Japan is the document work — the draft rules, the filing, the written opinion, the notice to staff — not the removal of a veto, because there is no veto to remove.

A realistic first ninety days

Weeks 1–2. Install, connect the gateway, connect identity. No scores are produced. Staff receive the data-collection notice and the individual dashboard before anything is measured, which is both the right order and the one that determines whether the programme has any credibility.

Weeks 3–8. Baselines establish. The first pulse round runs. Everyone is shown as “establishing baseline”; there are no risk bands yet, and claiming otherwise would be inventing signal from noise.

Weeks 9–12. The first long-form instrument runs. Drift indices become meaningful. The first amber bands appear, and this is the point at which the programme either has a conversation protocol or does not — we will push hard on having one before go-live, because an amber band with no agreed response is just a worse way of doing nothing.

Month 6. Intervention tracking starts paying for itself. You can see which changes moved the numbers and which were theatre. This is the output that justifies the next year’s budget, and it does not exist until you have two long-form cycles behind you.

The top tier is a set of promises, not a bigger licence

The software does not improve because the contract is larger. The instruments are the same instruments, the drift index is the same arithmetic, and the suppression rules are the same rules at every price. What changes is what we are obliged to, in writing, in the words below. That composition is the entire reason a deployment of this kind costs what it costs — and where an obligation belongs to the Cadence platform rather than to this product, it says so. You have one set of works councils. A vendor who bills that relationship once per product has sold you the same promise three times, and a procurement reviewer who notices is entitled to stop reading.

Named people, including one who will answer for the methodology. A named support engineer in the Americas, in EMEA and in APAC, and a named people scientist your HR function knows by name. Fifteen minutes to a first substantive response on a business-stopping incident, every hour of every day; escalation to a named incident manager at sixty minutes; a quarterly review at which you may refuse any of them. Specific to this product, and the part that matters most in practice: a named individual who answers for the methodology in front of a supervisory authority and in front of a works council — a person with a name, not “a representative of the company”, because a works council that has been sent a representative has learned something about how seriously it is taken. The market price of the fifteen-minute clock is published, if you know where to look: Salesforce sells a fifteen-minute Severity 1 response only in Signature, on top of a mandatory Premier tier, and a reseller’s filing on the UK government framework prints the ladder at £149,100 to £663,075 a year for a single Org. Named individuals price the same way — SAP’s Technical Quality Manager runs £550 to £2,600 per unit per day on the same framework. The round-the-clock rota is a Cadence property, covering Pulse, Signal and Ledger, and it is allocated across the three rather than charged whole against each.

A duty to detect and to route, with the clinical boundary written in. A round-the-clock desk, a contractual time to act once a band goes red, and provable screening coverage rather than an availability figure — paired with an explicit contractual disclaimer of clinical responsibility. We do not provide care, we do not employ clinicians, and we will not be paid as though we did. The scale of the adjacent obligation is public and worth knowing before you compare us to anything: the US General Services Administration committed $467,837,763.31 over five years to Carelon for the employee-assistance programme covering service members and their families, and $107,416,122.21 to Magellan at Health and Human Services. Now the part that argues against us, because you would reach it anyway: those contracts buy an obligation to provide care, which is exactly the obligation Signal disclaims. They tell you what the neighbouring need costs the same buyer. They do not price this product, and we will not borrow their weight.

An annual architectural attestation — and no warranty behind it. Once a year, an independent auditor examines whether any inference anywhere in the product is drawn from biometric data — face, voice, gaze, posture, physiological signal — and the report comes to you entire, including anything it finds. Alongside it, a binding undertaking that we will not introduce biometric inference by update without your written consent, which matters because liability under the Act attaches to the deployer for use: a feature added quietly converts a compliant deployment into a prohibited practice overnight. At Big Four German partner day rates the attestation is EUR 45,000 to EUR 75,000 of auditor time a year, and that is the whole cost of it.

What is deliberately not here is the thing this page used to be able to sell. There is no architectural warranty, and no indemnity reserve sized against the Article 5 fine tier. We could write one. It would read impressively. It would also be a promise not to build a feature we have never built, do not intend to build, and have told you on this page would be illegal — reserved against a probability nobody can source, for a fine that has never once been levied in Europe, under a EUR 35 million ceiling that does not even bind a buyer above EUR 500 million of turnover, which is the buyer this tier is for. A vendor charging you for its own intentions is charging you for nothing. The attestation is the part that costs real money and the only part you can check, so the attestation is the part we sell.

Works-council clearance, delivered, and counted once. Per jurisdiction: a technical annex mapping every configurable option in the product to a clause the council can enforce; a data-flow dossier in the council’s own language; named engineers present at council and CSE sessions; the council’s own expert funded under BetrVG §80(3) to a contractual ceiling; the Article 26(7) notice to worker representatives before the system goes into service; for Italy, a prepared agreement text for the RSU or RSA, or the filing to the Ispettorato Nazionale del Lavoro. What it saves you is measurable at the point it fails. A German negotiation that collapses goes to a conciliation board whose costs fall entirely on the employer under §76a(1) with no statutory ceiling: a chairperson at EUR 3,000 a day, two external assessors at seven tenths of that, counsel at EUR 250 to 600 an hour — EUR 36,300 to EUR 46,800 for a single episode, plus a rollout standing still. Below that sits an Ordnungsgeld of up to EUR 10,000 under §23(3). In France, skipping the CSE consultation is a criminal offence — EUR 7,500 for an individual, EUR 37,500 for a company, with a six-year limitation period running from the last act. In Italy the money is trivial and the exposure is not: the criminal route runs through Article 171 of the privacy code, and what deters is the custodial limb and the record attaching to a named officer. One honest note on a figure that circulates in this market: the EUR 250 hourly rate for a council’s expert is the council’s own 2011 resolution, recited in the facts of a case the council lost. The Federal Labour Court never approved it. It is a floor of fifteen years ago, not a benchmark, and a 2026 rate is likelier higher. All of this is a Cadence suite property, not a line against this product. One group works agreement covering Pulse, Signal and Ledger does most of the work once, and if clearance appears three times on a quotation you have been charged three times for one relationship — say so.

Regulatory operations for every country you deploy in. A complex-tier DPIA with national annexes, the legitimate-interest assessment, the fundamental rights impact assessment under Article 27, the transparency texts, the records of processing — and a re-run of the affected subset inside a contractual window every time the product or the law changes materially. The external fees alone are checkable: one EU-wide complex-tier assessment runs EUR 9,000 to 20,000, each national annex EUR 4,000 to 9,000, so a fifteen-country stack is EUR 65,000 to EUR 146,000 before anyone inside either company has done anything. None of these processes is expensive on its own. What defeats a large organisation is that they multiply, they all sit on the critical path of a deployment already paid for, and they run again on every material change. Part of this work is shared with the other Cadence products and is allocated, not charged whole.

Standing behind the access log when it is produced as evidence. The append-only log itself — who saw which employee’s data and when — belongs in the capabilities above. It is what the product is, and a vendor billing you for its own architecture is billing you for its QA. What the top tier adds is that we stand behind it: retention of not less than six months under Articles 19 and 26(6), extensible on your configuration; attendance at your audits; and a named person who will explain to a works council or a supervisory authority how the log is written and why no operation exists to edit it, including for us. For a screening product that is not clinical care, the ability to prove restricted access by log rather than by policy is the condition of existing in Europe at all.

Certifications maintained as deliverables, with the estimates quoted honestly. ISO 42001 as the governance artefact for the AI system, ISO 27701 as the core because workforce data is personal information by definition, C5 for Germany, and HITRUST r2 where the data touches health — carried as a deliverable for the term, with the certificates and their scope statements handed over rather than summarised. The cost of ISO 42001 for a large enterprise is not a settled number and we will not pretend otherwise: one published estimate puts full certification at $350,000 to $650,000, another at “from a few thousand to $75,000+”, and those differ by nearly an order of magnitude. HITRUST r2 is firmer — roughly $100,000 to $250,000 in the first year and $75,000 to $150,000 in steady state.

Service credits that accrue without you asking. 25% of the monthly fee for each hour of unplanned unavailability, calculated from our own monitoring and applied to the next invoice without a claim, not your sole and exclusive remedy, and not capped at six months of fees. All three of those are departures from the norm, which is why credits mostly go unclaimed — Cloudflare’s enterprise SLA states the six-month aggregate cap and the sole-remedy clause in terms, AWS requires a claim by the end of the second billing cycle, and one contract-review sample found 60% to 80% of earned credits were never requested because the process was manual. The rate and the absence of a cap are published here; what counts as unplanned and where the hour starts are defined in the contract — a credit whose trigger only we could read would be the old trick in new clothes. And the part we would rather say than have put to us: this obligation matters less here than almost anywhere. A pulse survey unreachable for three hours stops nothing. The difference between 99.9% and 99.99% is forty-three minutes a month against four on a system where nobody will notice either. What you should be paying attention to in our contract is the liability limit and the confidentiality terms, not the nines, and a vendor selling you uptime on a screening product is selling you the cheapest thing it has.

Deployment inside your perimeter, and the price fixed for the term. The product runs with the network cable out: updates shipped offline under a signed integrity manifest you can verify without us, telemetry that never leaves, and diagnosis performed against offline dumps because there is no other way to do it. Google publishes USD 300,000 a month as the floor for its air-gapped Distributed Cloud, on a system that can run on as few as four racks — which is the published price of the posture, not of this product. The perimeter deployment is a Cadence property too, allocated across Pulse, Signal and Ledger; one release train serves three. And the figure, whatever it turns out to be, is fixed for the term: no annual uplift, no CPI index, no recalculation when your headcount grows, no surcharge for an additional jurisdiction — and symmetrically, no clause preventing it from falling when your headcount shrinks. The norm we are declining is 3% to 10% a year across this category, and the largest vendor in it moved the other way: Microsoft raised E5 from $57.00 to $60.00 with effect from 1 July 2026 and withdrew the EA volume discount levels B to D in November 2025, so a hundred thousand seats no longer earn an automatic discount.

Four things are deliberately absent from that list, and each of them is something a vendor could plausibly have billed you for. Maintaining an individual baseline is not an obligation — it is the product, and splitting the core algorithm out as a priced line is an unbundling trick. Keeping that baseline intact across version changes is not one either: a longitudinal measure whose history breaks is not a measure, so that is engineering discipline we owe ourselves. Small-group suppression is what makes the aggregates lawful, not an upgrade. And having an MCP server is not a premium: being agent-addressable in 2026 is table stakes, Google has announced more than fifty managed MCP servers without publishing a price for any of them, and the line “we have an MCP server” does not move a quotation by a dollar. What is chargeable is the policy layer and the proof — and for this product specifically, the restriction: the agent path is truncated to aggregates by default, written into the specification rather than left as a setting, because full agent access to burnout screening data is not the removal of shadow AI, it is the creation of a disclosure channel into the most sensitive data the employer holds. Breach reports touching AI applications are now routine, and a substantial share of them runs through compromised APIs and plugins — the class of surface a screening product sits beside.

How the meter is shaped, and the part of this page that is weakest

Money is charged against one thing: each person in scope of screening, counted once a month. One meter, because a second meter is a price change wearing the clothes of a product update, and because a single unit is easier for you to argue with.

Everything this category conventionally charges for separately sits on the other side of that line. Not people who are not screened — managers, HR analysts, occupational health, administrators and works-council observers are never counted, where Viva Glint lists at $2.00 per user per month and the Viva suite at $12.00, both billed per user across the tenant, per Microsoft’s published pricing. Not depth of access: the wellbeing platforms take a small administrative fee per employee and then charge again for the fuller tier, Lyra quoted at $6–12 standard against $10–15+ with enhanced clinical access, Spring Health at $6–11 against $9–14 expanded. One signed public agreement shows how little of that model is actually the per-employee line: St Johns County, Florida contracted with Spring Health at a $5.04 PEPM administrative fee under an annual maximum of $377,000, where the per-employee charge is less than a tenth of the ceiling and the variable cost of care fills the rest. Signal has no second meter to run, because it delivers no care to meter, and every person sees their own complete file on every tier there is. Not frequency, not instruments, not languages — a meter on measurement teaches an organisation to measure less often, which is the precise opposite of what a longitudinal screening programme needs. And not agent calls, which are governed like a person and counted like a person: not at all.

There is no figure on this page and there will not be one. An individual, a thirty-person firm and a global group running this across fifteen jurisdictions pay amounts two orders of magnitude apart, and one number on a website is a lie at one end of that distribution and an insult at the other. What we publish instead is the unit, the list of what is never metered, the checkable test for whether the obligation tier is aimed at you, and the obligations themselves — which are the part that actually moves the number.

Now the weakest thing about this page, before you find it. Of everything we sell, Signal is the one with neither a published list price nor a public contract anywhere near the level the obligation tier is contracted at. Every observed deal in the employee-listening category sits under $139,920 a year — that is the top of the whole sub-category, not a median, and a top-tier Signal agreement is a different order of magnitude from it. The single software contract in the entire US federal register with “burnout” in its title is the Air Force’s ARENA STRIVE award to Arena Labs at $1,243,153.00, and that is below where this tier sits rather than above it. The employee-assistance contracts are unavailable to us by definition of the product, because they buy care. So the top tier here is not established by comparison with anything. It is established by the composition of obligations above and by what the exposure is worth to you — and if those obligations are not worth it to you, no arithmetic rescues the conversation, which is a thing both of us would rather learn in week one.

Two further honesties in the same direction. The qualifying test above is conjunctive where most of ours are disjunctive — all three conditions, not any one — and we have not measured how many organisations sit in that intersection. A narrow gate honestly stated is still a narrow gate. And when a federal contract is cited anywhere on this site as evidence of what a category costs, that is all it is evidence of. Hlebourg FZCO is established in the United Arab Emirates. A UAE entity cannot hold a US facility clearance — 32 CFR 117.9(c)(2) and (c)(3) require organisation under US law and location in the United States, and that test sits before any question of foreign ownership or control — and the UAE is not a Trade Agreements Act designated country, which closes most US federal procurement above the USD 174,000 threshold to us. Those contracts prove the category is bought at that level. They do not prove we are paid at it, and any vendor showing you a public award without drawing that line is inviting you to make the inference for them.