> For the complete documentation index, see [llms.txt](https://docs.xto10x.com/peoplecues/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.xto10x.com/peoplecues/surveys/getting-started-on-surveys/engagement-admin-and-surveys/create-and-manage-surveys/enps-survey-management/anonymity-in-enps-surveys.md).
# Anonymity in eNPS Surveys
## How Does Anonymity Work in eNPS Surveys?
At PeopleCues, **anonymity is a core principle -** it’s what enables employees to share honest, unfiltered feedback. We take this responsibility seriously and have built safeguards into every step of the process.
**What We Do to Protect Anonymity:**
* **No individual responses are shown.** Only aggregated results are visible to the Admins, HRs, leadership & managers.
* **Minimum threshold rule:** Feedback for a team or manager is shown only if there are **3 or more responses**, preventing the identification of individuals.
* **Text feedback is anonymized.** We share the manager-level text feedback with HR teams, without disclosing the author's identity. The verbatim is again only shared if the minimum threshold of 3 responses is met.
{% hint style="info" %}
Here is the [detailed document](broken://pages/V8j7ffH7J1A6me1CaQQ3) on how we protect anonymity in the reporting.
{% endhint %}
## **Anonymity**
Anonymity ensures that no user, regardless of their seniority in the hierarchy, can deduce the total score of any cohort with **three or fewer members**. This threshold prevents exposure of sensitive information through small group sizes.
* **Direct Anonymity:** Cohorts with fewer than 3 members are hidden entirely.
* **Indirect Anonymity:** Scores of other cohorts are masked or adjusted when their disclosure could indirectly reveal the scores of a cohort with fewer than 3 members.
### Anonymity in Org Hierarchy
For calculating the scores (eNPS/MRX/themes) for a leader we select which employees in their span can be added to sum making sure that in presence of the score of leaders below in hierarchy the anonymity principle never gets violated, i.e , the leader is never able to figure out the score of any cohort of employees less than 3 in size by looking at his score and the score of the leaders below in hierarchy.
> For instance consider the example below: In order to calculate the theme scores for Rajat we will take the cumulative of Samar, Vijay and Gaurav (people in Rajat's span). Now, who should be considered in the cumulative scores for Shantanu? If we consider all the people in the span, then Shantanu can subtract the cumulative score for Rajat (Samar+Vijay+Gaurav) from their score to figure out the sum of scores of Rajat and Tanmay. This harms our anonymity clause because it gives away the sum of scores for a cohort with size less than 3. So we can only consider Samar, Vijay and Gaurav for calculating Shantanu's score. This would make Shantanu's score the same as Rajat's score in this specific case. This might look like a lot of lost information but in big organizations with large hierarchies the most people in the span get accounted for in the leader score without anonymity compromise.
### Anonymity in Deep Dive
In the deep dive section in addition to direct anonymity which means hiding cohorts with size less than 3 we also practice indirect anonymity. This involves hiding the 2nd smallest cohort and even the 3rd smallest cohort ensuring that the total no. of people in the cohorts that are hidden are atleast 3. For example in if the department wise split:
> If the no. of people in the Product is 1 and Tech is 4 and the rest of the departments have size >4 then we will hide both Product and Tech to make sure that the size of hidden cohorts is at least 3. Had we chosen to not hide Tech the user can figure out the score for employee in Product by subtracting the available department scores from the overall score, which can be used to profile the employee. Indirect anonymity is integral here to protect user profiling.
### FAQ
1. Why is the Overall score in the deep dive table cumulative of the visible cohorts instead of the real score?
> If PeopleCues gives the Overall score then the user can figure out the score for the cohorts hidden due to anonymity. This is also why you might see some discrepancy in the overall score on the heatmap and deep dive.
## **Why Do Respondents Need to Log In If the Survey Is Anonymous?**
While survey responses are anonymous, logging in plays a key role in ensuring data quality and enabling meaningful insights:
* **Prevents multiple/unauthorized** **submissions:**\
Log-in ensures that each employee can submit the survey only once, and prevents unauthorized users from submitting fake or duplicate responses, thereby maintaining the integrity and reliability of the data — something that isn't possible in a non-login setup.
* **Enables demographic-level analysis:**\
Log-in allows PeopleCues to link survey responses to existing employee data (like tenure, department, or location). This lets HR and leadership **slice and analyze data** by relevant segments, without ever identifying individual respondents.
* **Maintains strict access controls:**\
Only aggregated results are visible, and only to HR teams and authorized leaders. Backend permissions ensure that no individual response can be traced back to an employee, directly or indirectly.
## How does PeopleCues handle my data?
At xto10x, the **security of your data is a top priority**. We are an ISO certified platform and follow best-in-class practices for secure data handling and infrastructure design.
*Learn more about our security and privacy practices:* [*xto10x.com/security*](https://www.xto10x.com/security)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.xto10x.com/peoplecues/surveys/getting-started-on-surveys/engagement-admin-and-surveys/create-and-manage-surveys/enps-survey-management/anonymity-in-enps-surveys.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.