Privacy and Anonymity

Engagement surveys may include sensitive feedback about leadership, culture, and workplace experience. This system is designed to protect respondents while allowing the organization to learn and improve.

1. Clear privacy modes

Every survey clearly states whether it is anonymous or identified. The privacy mode is shown before you begin. You should not have to guess how your responses will be handled.

2. Anonymous surveys

In anonymous surveys, results are displayed only in grouped form. Individual responses are not shown with names or identities in the app.

Minimum group size protection

Results are displayed only when a reporting group meets the minimum response threshold defined for that survey. If fewer than the required number of people respond, results are not shown.

This reduces the risk of identifying individuals in small groups.

Preventing duplicate submissions

To protect the integrity of results, the system prevents the same logged-in person from submitting the same survey run more than once.

For anonymous surveys, this is enforced using a one-way coded key derived from your account. The platform does not store a map between your account and your individual answers, and your employee record is not attached to your response. The coded key lets the system detect a second submission and send reminders only to people who have not yet responded, without naming you in any reporting view. Identified surveys are the exception: by design they keep the link between you and your answers, and that is stated before you begin.

3. Protection against indirect identification

Anonymity is not limited to hiding names. The platform restricts reporting views that could isolate individuals.

Data slices below the minimum threshold are automatically hidden.
Managers cannot combine filters to isolate individuals.
Drill-down views are restricted when they risk identification.
So a manager can see their own team's results, an anonymous answer is tagged with a team grouping rather than a person: the nearest manager above you whose team is already large enough to report on. Teams too small to report on are rolled into a bigger one, so the tag never narrows an answer to you.
These protections are enforced through platform rules and access controls.

4. Identified surveys

In identified surveys, responses are linked to individuals. This is clearly communicated before the survey begins.

5. Organization data (BambooHR)

Organizational structure data from BambooHR, including team, department, and manager relationships, is used to generate aggregated reporting groups.

In anonymous surveys, this data is used only to determine reporting structure. Individual survey responses are not displayed with identities in reporting views.

6. Free-text responses

Open-text comments can unintentionally identify individuals. Depending on survey settings, comments may be restricted, shown only above higher response thresholds, or limited to P&C review.

Please avoid including personal identifying details in free-text responses.

7. Data retention

Survey results may be retained to support engagement trend tracking over time. Access remains role-based, and reporting continues to follow the privacy mode selected for each survey.

8. Our commitment

Psychological safety matters. People should be able to share feedback without fear of being singled out.

Survey data exists to improve our workplace and strengthen leadership. It is not used to single out or penalize individuals.

If you have concerns about privacy or survey handling, please contact P&C.