Privacy and Anonymity
Engagement surveys may include sensitive feedback about leadership, culture, and workplace experience. This system is designed to protect respondents while allowing the organization to learn and improve.
1. Clear privacy modes
Every survey clearly states whether it is anonymous, confidential, or identified. The privacy mode is shown before you begin. You should not have to guess how your responses will be handled.
2. Anonymous surveys
In anonymous surveys, results are displayed only in grouped form. Individual responses are not shown with names or identities in the app.
Minimum group size protection
Results are displayed only when a reporting group meets the minimum response threshold defined for that survey. If fewer than the required number of people respond, results are not shown.
This reduces the risk of identifying individuals in small groups.
Preventing duplicate submissions
To protect the integrity of results, the system prevents the same logged-in person from submitting the same survey run more than once.
For anonymous surveys, this is enforced using an internal respondent key derived from your account. The platform also retains a coded link between accounts and responses so it can prevent duplicates, send reminders only to people who have not yet responded, and build aggregated reporting. This identity-linked data is not shown in reporting views and is accessible only to authorized administrators.
3. Protection against indirect identification
Anonymity is not limited to hiding names. The platform restricts reporting views that could isolate individuals.
- Data slices below the minimum threshold are automatically hidden.
- Managers cannot combine filters to isolate individuals.
- Drill-down views are restricted when they risk identification.
- These protections are enforced through platform rules and access controls.
4. Confidential surveys
In confidential surveys, access to individual responses is limited to authorized personnel. Managers receive aggregated reporting only. This mode is not anonymous to the system.
5. Identified surveys
In identified surveys, responses are linked to individuals. This is clearly communicated before the survey begins.
6. Organization data (BambooHR)
Organizational structure data from BambooHR, including team, department, and manager relationships, is used to generate aggregated reporting groups.
In anonymous surveys, this data is used only to determine reporting structure. Individual survey responses are not displayed with identities in reporting views.
7. Free-text responses
Open-text comments can unintentionally identify individuals. Depending on survey settings, comments may be restricted, shown only above higher response thresholds, or limited to P&C review.
Please avoid including personal identifying details in free-text responses.
8. Data retention
Survey results may be retained to support engagement trend tracking over time. Access remains role-based, and reporting continues to follow the privacy mode selected for each survey.
9. Our commitment
Psychological safety matters. People should be able to share feedback without fear of being singled out.
Survey data exists to improve our workplace and strengthen leadership. It is not used to single out or penalize individuals.
If you have concerns about privacy or survey handling, please contact P&C.