The standard every audit is held to.
One written set of rules decides how questions are written, how visits are checked, how scores are made and what clients and shoppers can rely on. The platform enforces it, every score names the version it was made under, and this page publishes it.
- Version
- 1.10
- Updated
- 1 Nov 2026
- Chapters
- 23
- Rules
- 157
- Enforced by the engine
- 75%
Most rules aren't a promise. They're code.
The platform won't let it be broken: a questionnaire, visit or score that fails the rule can't be saved, submitted or shown.
A reviewer checks it before a visit counts. The platform flags what to look at; a person decides.
How we work and what we ask of auditors and clients, written down so it can be held to.
23 chapters, 157 rules.
6 chapters are published word for word below. For the rest, the summary and the name of every rule are public; the detail stays with the engine that applies it.
- 015 rulesPublished in full
Principles
What a Mysterya audit measures, and the promises it makes to the client, the auditor and the staff being observed.
- 024 rules
Experience outcomes
The six outcomes every client sees on their dashboard. Each question maps to exactly one, chosen by what the customer gains or loses, not by the department involved.
The rules in this chapter
- E1Exactly one outcome per question
- E2Tag by customer impact
- E3Every outcome is measured
- E4Delight is above the promise
- 036 rules
Taxonomy and tagging
How every question is attached to the journey and the organisation, so results can be sliced any way the client asks.
The rules in this chapter
- T1Closed lists only
- T2One value per dimension
- T3Every question sits on a touchpoint
- T4Department follows ownership
- T5Stages follow the customer's journey
- T6Touchpoints have a one-line name and an icon
- 0411 rules
Vocabulary
One word, one meaning. Every name Probe, Echo, the engine, exports and AI answers use comes from the Mysterya dictionary, so the same word always means the same thing to the client, the auditor and the code.
The rules in this chapter
- D1The dictionary is the source
- D2A card is named after what it plots
- D3Three levels of place
- D4When, where, what kind
- D5Channel is how, touchpoint is the thing
- D6Standards are the same everywhere
- D7Workspace lists belong to the client
- D8The client's words are kept
- D9Missing stays missing
- D10A category is never a place or a step
- D11New words enter through the dictionary
- 0510 rules
Writing questions
What makes a question auditable. These rules are given to the AI writer word for word and checked afterwards.
The rules in this chapter
- Q1One behaviour or condition
- Q2Yes is always good
- Q3Concrete thresholds
- Q4No mind-reading
- Q5Answerable on one visit
- Q6Short and plain
- Q7Pass and fail are spelled out
- Q8N/A only when the situation may not arise
- Q9One check per thing
- Q10Reviewed as a whole before it is saved
- 063 rules
Answer types
Which answer type to use, and when. Yes / No is the default because it is the most reliable across auditors.
The rules in this chapter
- A1Yes / No first
- A2Impressions come last
- A3Open text is not scored
- 078 rules
Weight, criticality and scoring
How answers become scores, and how serious failures are escalated without distorting the score.
The rules in this chapter
- S1Weight is customer impact
- S2Criticality is capped
- S5Every flag has a reason
- S6Doctrine rules set a floor
- S7Possibly critical goes to a person
- S8What a failure triggers
- S3The score
- S4Bands
- 088 rules
Weighting
How the score is shared between basics, performance and the wow, so the number tracks what drives loyalty and not just how many basics were listed.
The rules in this chapter
- W1Tiers get a share of the score, not a share of the checks
- W2Positioning sets the mix
- W3A single extra never outweighs the basics
- W4Flags weigh more inside their tier
- W5First and last impressions
- W6Many checks on one thing share weight
- W7Readable numbers
- W8Data corrects the plan
- 0913 rules
Evidence
How much proof a visit must carry, and what counts as a comment a client can act on.
The rules in this chapter
- E1Every questionnaire has evidence rules
- E2A No needs proof
- E3Checks that must be photographed
- E4Minimum share of photos and comments
- E9The shopper stays a mystery
- E10Only ask for proof a camera can give
- E12Never at the auditor's risk
- E13Private places and other people's things
- E14The photo decision, in order
- E5What a usable comment is
- E6Comments the engine refuses
- E7Client vocabulary
- E8The engine reports its plan
- 104 rules
Coverage
A survey measures the whole journey, not the parts that were easiest to write about.
The rules in this chapter
- C1Every stage, every touchpoint
- C2Every outcome
- C3Every department that serves the customer
- C4Every channel the brand runs
- 113 rules
Evidence, continued
When a claim needs proof, and what proof is acceptable.
The rules in this chapter
- V1Required evidence
- V2What evidence may show
- V3Timings are recorded, not remembered
- 1212 rules
Photo checks
How Mysterya's AI reads every evidence photo, what it may say, who sees it, and how people correct it.
The rules in this chapter
- F1Every photo, once, at submission
- F2Three questions per photo
- F3Suggestions, never scores
- F4Only what the venue controls
- F5Only when sure
- F6Neutral words
- F7People are never the subject
- F12The shopper stays anonymous
- F8Who sees what
- F9People correct the AI
- F10Paid per photo, capped
- F11Model and date on every result
- 135 rules
Auditor comments
Comments are where insight comes from. They explain the answer, they do not repeat it.
The rules in this chapter
- M1Every failure is explained
- M2What, when, who (by role), impact
- M3Consistent with the answer
- M4Praise is recorded too
- M5No personal judgements or names
- 146 rules
Fieldwork and QA review
No visit reaches a client dashboard until it has passed QA review.
The rules in this chapter
- R1Checks before review
- R2Plausible duration
- R3Reviewer decisions
- R4Contradictions are resolved
- R5Auditor quality
- R6Appeals
- 156 rules
Insights and reporting
How results become findings a client can act on — and the limits on what a result is allowed to claim.
The rules in this chapter
- I1Enough data or no number
- I2Movement versus noise
- I3Findings cite evidence
- I4Drivers, not just scores
- I5Comment themes are grounded
- I6Compare like with like
- 163 rules
Actions and closed loop
A failure that matters becomes an action with an owner, and the next visit checks it was fixed.
The rules in this chapter
- L1Critical failures open actions
- L2Due dates by severity
- L3Verified on the next visit
- 175 rules
AI in the engine
What the AI is allowed to decide, and what code decides instead.
The rules in this chapter
- G1AI writes, code decides
- G2Every survey is stamped
- G3Simulated data is labelled
- G4No AI answers in live fieldwork
- G5A human signs off
- 1811 rulesPublished in full
Research quality
How a Mysterya programme meets the requirements of ISO 20252:2019 for market, opinion and social research: an agreed brief, a controlled instrument, vetted fieldworkers, every visit validated, and results that state their own limits.
- 197 rulesPublished in full
Verified score
Every overall score says how sure it is and how it was checked: a range, six named checks and one confidence level, worked out the same way in Echo, reports and the API.
- 207 rulesPublished in full
Benchmarks
How a client's results can help build an industry index: only by choice, only as anonymous totals, only once enough organisations take part, and withdrawn the moment they say so.
- 2110 rulesPublished in full
Data protection
How Mysterya handles the personal data of clients, their teams and auditors, in line with the GDPR, the UAE's Federal Decree-Law 45 of 2021, Saudi Arabia's PDPL and Egypt's Law 151 of 2020.
- 228 rulesPublished in full
Protecting the shopper
A mystery shopper who is recognised stops being a mystery shopper. These rules keep every auditor anonymous to the venues they visit and to the clients who read their work.
- 232 rules
Industry packs
Sector knowledge the engine starts from: the journey, the touchpoints and the legal musts. Clients' own lists always take priority.
The rules in this chapter
- K1Packs are a starting point
- K2Local law is critical
Principles
What a Mysterya audit measures, and the promises it makes to the client, the auditor and the staff being observed.
- P1Observe, never infer
An audit records what an ordinary customer could see, hear or measure. It never records what staff intended, felt or were trained to do.
Inference makes results unfalsifiable and unfair to staff.
- P2The customer's lens
Every question is written from the customer's side of the counter. Back-office processes, systems and staff welfare are out of scope unless the customer experiences their effect.
- P3Fair to staff
Results describe the experience, not the person. Comments may describe a role and behaviour but never judge character, and staff names never appear in reports shared outside the location's management.
- P4One truth per visit
An auditor's answers, timings, comments and evidence must tell one consistent story. Contradictions are resolved in QA review before a visit counts.
- P5Numbers need enough evidence
A score is shown only when enough answers sit behind it (see Numbers). Below that it is shown as 'not enough data', never as a number.
Research quality
How a Mysterya programme meets the requirements of ISO 20252:2019 for market, opinion and social research: an agreed brief, a controlled instrument, vetted fieldworkers, every visit validated, and results that state their own limits.
- N1Aligned, never claimed as certified
Mysterya's method is aligned with ISO 20252:2019. Mysterya is not certified to it, and no page, proposal or report may say it is. Each rule in this chapter names the area of the standard it answers.
A standard is only worth quoting if the claim is exact.
- N2An agreed brief before fieldwork
Every programme carries a written brief (what the brand wants to learn and what good looks like), its scenarios, locations and schedule before the first visit is booked. Changes to the brief after launch are recorded with their date. (ISO 20252: agreeing the research requirements.)
- N3A controlled, versioned instrument
A questionnaire is a draft until a programme manager publishes it. Every published version is numbered and stamped with the doctrine version it was checked against, and every visit records the version it was answered on. (ISO 20252: questionnaire design.)
- N4Fieldworkers are identified and vetted
An auditor applies with an identity document, is 18 or over, and is checked by Mysterya staff before they can be offered a single visit. Applications that fail the check are declined or asked for new documents, never approved by default. (ISO 20252: fieldworker recruitment.)
- N5Every visit is briefed
Before a visit the auditor sees the scenario, the timing rules, what evidence is needed, the rules that apply to them, and every question they will answer. (ISO 20252: fieldworker briefing.)
- N6Every visit is validated
Every submitted visit is checked automatically (timings, location, photos, consistency) and then reviewed by a person before it can count. ISO 20252 asks for at least 10% of fieldwork to be validated; Mysterya validates all of it. (ISO 20252: fieldwork validation.)
- N7No conflicts, no over-exposure
Auditors declare the brands they work for or are close to and are never sent to them. One auditor makes at most one visit to a brand in a wave, so staff do not learn a face. (ISO 20252: fieldworker conduct.)
- N8Subcontracted fieldwork meets the same rules
A field partner works under a written contract with the brand, uses auditors held to the same rules, and every visit it delivers is reviewed by the brand exactly like any other. (ISO 20252: subcontracting.)
- N9Every change after fieldwork is traceable
A reviewer's adjustment, an upheld dispute or a rescoring keeps the original answer, the person, the reason and the date. Nothing is overwritten silently. (ISO 20252: data management and processing.)
- N10Records are kept
Answers, timings, check-in locations, original photos, reviewer decisions with their reasons, and every staff action are kept for the life of the programme so any result can be traced back to the visits behind it. (ISO 20252: retention of records.)
- N11Results state their own limits
Every score shows how many visits are behind it, scores with too little behind them are shown as 'not enough data', every overall score carries its Verified Score (VS1), and a wave is only final once it is released. (ISO 20252: reporting.)
Verified score
Every overall score says how sure it is and how it was checked: a range, six named checks and one confidence level, worked out the same way in Echo, reports and the API.
- VS1Every score carries its range
An overall score is shown with ± how far another round of visits could move it: 1.96 × the typical difference between visits to the same place in the same wave, divided by the square root of the visits behind it. With too few repeat visits the spread of all visit scores is used instead, which errs wide. Under three visits there is no range: the score says the range comes after three visits and names what did pass, because few visits is not a fault.
A score without its margin invites people to act on noise.
- VS2Six named checks, judged the same way
The score is judged on: its range (good up to ±2.5, watch up to ±5); reviewer approval (only approved visits ever count); the automatic quality checks (good when at least 90% of checked visits are clean and none has a serious finding, watch from 70%); the photos behind failed checks (good when at least 85% of the photos our check could read agree with the auditor and none disagrees, watch from 65%); the auditor correction (good within 1 point, watch within 2.5); and open client disputes (watch while any is open).
- VS3Not measured is not passed
A check with too little behind it is shown as not measured, never as good: quality checks run on fewer than half the visits, fewer than 10 photo verdicts, or no auditor recorded. High confidence needs the range, the quality checks and the photo check all measured and all good.
- VS4One confidence level
Any weak check makes the score low confidence; any check to watch makes it medium; high needs every measured check good (VS3). The level and the reason are shown beside the score.
- VS5Auditors are compared like for like
How strictly an auditor marks is measured only on the same check at the same location as other auditors, weighted by the check's points, so a better-run place never makes its auditor look generous. The lean is shrunk towards zero until it rests on 40 shared answers, counts only from 20, and only when at least three auditors can be compared: with two, they differ but neither can be called nearer the truth.
- VS6The corrected score sits beside the score, never in place of it
The score corrected for how each auditor marks is shown next to the reported score as a check on it. The reported score is always the one calculated from the recorded, reviewed answers.
A client must be able to trace every reported number back to answers on visits.
- VS7Built to this doctrine
Every Verified Score names the doctrine version it was judged against, and the words and thresholds above live in one place that Echo, reports and the API all read.
Benchmarks
How a client's results can help build an industry index: only by choice, only as anonymous totals, only once enough organisations take part, and withdrawn the moment they say so.
- BM1Off until the client turns it on
A workspace contributes to benchmarks only after one of its owners or admins (or an owner or admin of the agency that runs it) turns it on, or Mysterya records a signed agreement for it. Every workspace starts with it off.
Results belong to the client. Taking part has to be a decision, not a default.
- BM2Only anonymous totals leave the workspace
What goes into an index is each contributing organisation's share of available points on checks tagged to each Experience, per sector and country, across its scored visits. Nothing that names or describes the client, its places or its people is ever part of it.
- BM3One organisation, one vote
Each organisation's figure counts once, whatever its number of locations, so a large client cannot set the index on its own.
- BM4Shown only above the floor
A benchmark figure is shown only when at least 5 organisations and 20 locations stand behind it and no single organisation holds more than 40% of those locations. Mysterya can raise these numbers, never lower them.
With fewer, a figure could be traced back to one client.
- BM5Withdraw at any time, completely
Turning it off removes the workspace from every index, including figures already shown, the next time any of them is read. Nothing is kept for later.
- BM6Give to get
Only workspaces that contribute see how they compare with their index. A workspace that does not take part sees how far its index is from being shown, never the figures.
- BM7Every decision is recorded
Each change records who made it, when, on whose behalf (the client, its agency or Mysterya) and the doctrine version it was made under. The history is kept and shown to the workspace.
Data protection
How Mysterya handles the personal data of clients, their teams and auditors, in line with the GDPR, the UAE's Federal Decree-Law 45 of 2021, Saudi Arabia's PDPL and Egypt's Law 151 of 2020.
- U1Only what the work needs
Mysterya collects the personal data an audit, an account or a payout needs, and nothing for its own sake. Shoppers are never asked to record anything about people beyond what a check requires.
- U2Who is responsible for what
For a programme's results, the client decides what is collected and why, and Mysterya processes it on their behalf. For an auditor's own account, identity and payouts, Mysterya is responsible.
- U3Access by need, enforced in the database
Every table carries row-level security, so a person can only read what their workspace, role and scope allow, whichever screen, export or API asks. Mysterya staff sign in with a second factor.
- U4Encrypted in transit and at rest
All traffic uses TLS. Data and files are encrypted at rest by the hosting providers. API keys are stored only as hashes, and accounting-tool tokens are sealed with AES-GCM before they are saved.
- U5Staff actions are logged
Every action Mysterya staff take on a customer's account is written to an audit log that cannot be edited or deleted from the application.
- U6Where data is hosted, said plainly
Data is hosted in the United States (AWS us-east-1) on infrastructure certified to SOC 2 and ISO/IEC 27001. Every provider that handles personal data is named on the trust page, with what it handles. A new provider is added there before it receives data.
- U7AI never trains on customer data
AI features reach model providers only through the AI gateway, under API terms that exclude training on the data sent. Photos are checked for privacy before any client sees them.
- U8People's rights are answered
Anyone can ask to see, correct, export or delete their personal data, or object to its use, from the form at /privacy/request. The person confirms their email first; the request is then answered within 14 days and tracked in Console › Data requests. Erasure follows one data map of every table that points at a person: the account and what identifies them is deleted, client results stay without a link to them, and records the law makes us keep (invoices, payments) are kept with the reason recorded. Where Mysterya processes the data for a client, the client is told and decides with us.
- U9Kept no longer than needed
Programme data is kept while the client's contract runs and deleted on request when it ends. Website and app analytics are deleted after 13 months.
- U10Incidents are reported
If personal data is exposed, affected clients are told without undue delay and within 72 hours of Mysterya confirming it, with what happened, what was affected and what is being done.
Protecting the shopper
A mystery shopper who is recognised stops being a mystery shopper. These rules keep every auditor anonymous to the venues they visit and to the clients who read their work.
- H1Clients see a code, never a name
Wherever a client reads a visit (Echo, Probe, exports, decks, Ask and the API) the auditor is shown as a code such as A-1234. The only exception is a company's own auditors, whom it already employs.
A client who knows who the shopper is can tell their staff.
- H2No contact details cross
Clients never see an auditor's email, phone, address, payout details or identity documents. Every message between a reviewer and an auditor goes through Mysterya.
- H3Photos never give the shopper away
The auditor's name, email, phone, booking or confirmation numbers and loyalty numbers are blurred wherever they appear in a photo, before any client can see it.
- H4Discreet in the field
Auditors never photograph staff or other guests, and checks about people need no photo: the comment is the proof. A check that would make the auditor stand out never requires a photo.
- H5Not the same face too often
One auditor makes at most one visit to a brand in a wave, and a programme can cap how many of its brands one auditor visits in a wave.
- H6Conflicts are declared
Auditors list the brands they work for or are close to. They are never offered, invited to or able to claim a visit to those brands.
- H7Identity documents are locked away
Identity documents sit in private storage that only Mysterya staff can open, through a link that expires after five minutes. They are never shown to a client.
- H8Disputes are about the answer, not the person
A client may dispute an answer and see how it was decided. They may not ask who made the visit, and Mysterya will not tell them.
Every version, and what it changed.
- 1.101 November 2026
- New chapter Benchmarks (BM1–BM7): contributing is off until the client turns it on, only anonymous totals per Experience are shared, figures show only above a floor Mysterya can raise but never lower, withdrawal is complete, only contributors see how they compare, and every decision is recorded.
- 1.91 November 2026
- New chapter Verified score (VS1–VS7): every overall score carries its range, six named checks (range, reviewer approval, quality checks, photos behind failures, auditor correction, disputes) and one confidence level, with the thresholds written down.
- N11 now requires every overall score to carry its Verified Score.
- 1.825 October 2026
- New chapter Research quality (N1–N11): how a programme meets ISO 20252:2019, area by area — aligned, never claimed as certified.
- U8 rewritten: requests come in through /privacy/request, are answered within 14 days (was 30) and erasure follows one data map of every table that points at a person.
- New chapter Data protection (U1–U10): GDPR, UAE PDPL (Federal Decree-Law 45/2021), Saudi PDPL and Egypt Law 151/2020 — access, encryption, hosting, rights, retention, incidents.
- New chapter Protecting the shopper (H1–H8): codes not names, no contact details, blurred photos, discretion, exposure limits, conflicts, locked identity documents.
- 1.724 October 2026
- Writing: Q9 "One check per thing" now defines a repeat (one answer always decides the other) and what is not one; E11 merged into it. New Q10: every written questionnaire is reviewed as a whole before it is saved — repeats across stages removed, overlaps reported, imports reported only.
- Evidence: unsafe moments moved out of E10 into their own rule E12 (traffic, driving, security, heights, no-photo places). New E13: private places and other people's things — washrooms, changing and prayer rooms, children, other guests' belongings, PIN entry — photo only when empty, never required.
- Evidence: new E14 "The photo decision, in order" — safe? private? about a person? can a camera show it? visual or disputable? — decided once per check and saved, so every surface reads the same rule.
- The writer is now given Q9 and the evidence rules E3, E9, E10, E12–E14 word for word.
- 1.623 October 2026
- Evidence: the shopper stays a mystery (E9) — checks about staff or other guests never require a photo, not even for a No; the comment is the proof.
- Evidence: only ask for proof a camera can give (E10) — timings, sound, smell, taste, temperature and the shopper's own view never require a photo; photo share is counted over photographable checks only (E4).
- Evidence: E3 no longer lists uniform and grooming. New E11: one check per thing, repeats removed and visits rescored.
- 1.521 October 2026
- New chapter Photo checks (F1-F11): AI reads every evidence photo at submission; findings are suggestions that never change a score; only conditions the venue controls; neutral wording; people and personal details blurred for clients; Echo users can mark a finding "Not an issue".
- 1.420 October 2026
- New rule T6: every touchpoint has a one-line name (at most 28 characters) and one icon from the closed icon list.
- 1.320 October 2026
- New chapter Evidence (E1–E8): minimum share of photos and comments per visit, a No needs a photo and a comment, what a usable comment is and which comments the engine refuses.
- 1.220 October 2026
- New chapter Weighting (W1–W8): each Kano tier gets a share of the score set by the brand's positioning, so Delighters carry real weight even when they are few.
- S1 now points to the Weighting chapter; weights run from 1 to 10 in halves.
- 1.112 October 2026
- New chapter Vocabulary (D1–D11): the Mysterya dictionary becomes part of the doctrine.
- T1 now allows an imported questionnaire's own groupings, kept as client categories (D8).
- T3 defines a touchpoint as the exact thing the customer deals with, in line with the dictionary.
- 1.028 September 2026
- First edition: 13 chapters, 64 rules.
Mysterya Audit Doctrine, version 1.10 (asd-1.10), 1 November 2026. mysterya.cx/doctrine
Every score, report and API result names the version it was made under, so a figure can always be traced back to the rules that made it. Trust and security covers hosting and certifications.