Confidential vs anonymous — use precise words
Truly anonymous usually means the platform never stores a link from response to identity. Confidential often means identity exists for administration (reminders, eligibility) but is withheld from managers and reports. Say which model you run — overclaiming “anonymous” when you mean “confidential with thresholds” destroys trust when someone asks a smart question.
Small groups stay protected
Dashboards, manager packs, and exports do not show a group when that group is too small to protect a person. The floor is confirmed for the programme before fieldwork opens.
- Engagement and pulse reports open for groups large enough that a reader cannot identify someone.
- 360° rater groups are often smaller, and the same protection still applies.
- Changing that floor is agreed before the survey opens, not during fieldwork.
Access control and comment safety
Role-based access keeps board packs, HR analytics, and manager scorecards in separate permission lanes. Comment intelligence links themes to sample quotes only when k-anonymity rules are met — so managers discuss patterns, not people.
Communicate the rules before fieldwork
Trust rises when the invite states: who can see what, the minimum group size, whether open text can appear in manager packs, and how long identifiable admin data is retained. Put the same text in Arabic and English when you run bilingual programmes.
Frequently asked questions
Can HR see who said what?
In a properly configured programme, HR sees aggregates and k-anonymous quote samples — not a named comment feed. Admin identity for reminders is separated from analytic views.
How are small groups protected?
Results are shown only when a group is large enough that a person is not identifiable. The reporting control is confirmed for each programme before the survey opens.