Anonymity in eNPS Surveys
How Does Anonymity Work in eNPS Surveys?
At PeopleCues, anonymity is a core principle - it’s what enables employees to share honest, unfiltered feedback. We take this responsibility seriously and have built safeguards into every step of the process.
What We Do to Protect Anonymity:
No individual responses are shown. Only aggregated results are visible to the Admins, HRs, leadership & managers.
Minimum threshold rule: Feedback for a team or manager is shown only if there are 3 or more responses, preventing the identification of individuals.
Text feedback is anonymized. We share the manager-level text feedback with HR teams, without disclosing the author's identity. The verbatim is again only shared if the minimum threshold of 3 responses is met.
Anonymity
Anonymity ensures that no user, regardless of their seniority in the hierarchy, can deduce the total score of any cohort with three or fewer members. This threshold prevents exposure of sensitive information through small group sizes.
Direct Anonymity: Cohorts with fewer than 3 members are hidden entirely.
Indirect Anonymity: Scores of other cohorts are masked or adjusted when their disclosure could indirectly reveal the scores of a cohort with fewer than 3 members.
Anonymity in Org Hierarchy
For calculating the scores (eNPS/MRX/themes) for a leader we select which employees in their span can be added to sum making sure that in presence of the score of leaders below in hierarchy the anonymity principle never gets violated, i.e , the leader is never able to figure out the score of any cohort of employees less than 3 in size by looking at his score and the score of the leaders below in hierarchy.
For instance consider the example below: In order to calculate the theme scores for Rajat we will take the cumulative of Samar, Vijay and Gaurav (people in Rajat's span). Now, who should be considered in the cumulative scores for Shantanu? If we consider all the people in the span, then Shantanu can subtract the cumulative score for Rajat (Samar+Vijay+Gaurav) from their score to figure out the sum of scores of Rajat and Tanmay. This harms our anonymity clause because it gives away the sum of scores for a cohort with size less than 3. So we can only consider Samar, Vijay and Gaurav for calculating Shantanu's score. This would make Shantanu's score the same as Rajat's score in this specific case. This might look like a lot of lost information but in big organizations with large hierarchies the most people in the span get accounted for in the leader score without anonymity compromise.
Anonymity in Deep Dive
In the deep dive section in addition to direct anonymity which means hiding cohorts with size less than 3 we also practice indirect anonymity. This involves hiding the 2nd smallest cohort and even the 3rd smallest cohort ensuring that the total no. of people in the cohorts that are hidden are atleast 3. For example in if the department wise split:
If the no. of people in the Product is 1 and Tech is 4 and the rest of the departments have size >4 then we will hide both Product and Tech to make sure that the size of hidden cohorts is at least 3. Had we chosen to not hide Tech the user can figure out the score for employee in Product by subtracting the available department scores from the overall score, which can be used to profile the employee. Indirect anonymity is integral here to protect user profiling.
FAQ
Why is the Overall score in the deep dive table cumulative of the visible cohorts instead of the real score?
If PeopleCues gives the Overall score then the user can figure out the score for the cohorts hidden due to anonymity. This is also why you might see some discrepancy in the overall score on the heatmap and deep dive.
Why Do Respondents Need to Log In If the Survey Is Anonymous?
While survey responses are anonymous, logging in plays a key role in ensuring data quality and enabling meaningful insights:
Prevents multiple/unauthorized submissions: Log-in ensures that each employee can submit the survey only once, and prevents unauthorized users from submitting fake or duplicate responses, thereby maintaining the integrity and reliability of the data — something that isn't possible in a non-login setup.
Enables demographic-level analysis: Log-in allows PeopleCues to link survey responses to existing employee data (like tenure, department, or location). This lets HR and leadership slice and analyze data by relevant segments, without ever identifying individual respondents.
Maintains strict access controls: Only aggregated results are visible, and only to HR teams and authorized leaders. Backend permissions ensure that no individual response can be traced back to an employee, directly or indirectly.
How does PeopleCues handle my data?
At xto10x, the security of your data is a top priority. We are an ISO certified platform and follow best-in-class practices for secure data handling and infrastructure design.
Learn more about our security and privacy practices: xto10x.com/security
Last updated