eNPS and Pulse Surveys, With Anonymity Enforced in the Math
A hard k-anonymity floor means any driver, team slice, or manager cut answered by fewer than three people is mathematically suppressed - the aggregate for a group under the floor is never even computed. Add deterministic driver correlation, and you get a survey you can act on and an employee can actually trust. Anonymity isn’t a promise under the form; it’s a property of the computation.
Illustrative product view
K-anonymity that lives in the computation
Any breakdown that would expose an answer from fewer than three people - a single driver, a team slice, a manager’s direct reports - is suppressed before it is ever shown, because the aggregate for a group under the floor is never computed in the first place. It is not a display-time filter that a report export could bypass; it is enforced where the numbers are made.
Deterministic driver correlation
Each pulse computes which drivers move eNPS the most using a deterministic correlation: the same responses always produce the same ranking. So when the tool says “recognition is the top lever this quarter,” you can act on it without wondering whether a stochastic model would have reshuffled the order on a re-run.
Why “we promise it’s anonymous” isn’t the same
Culture Amp and 15Five protect anonymity by policy and by minimum-response thresholds applied when a report is rendered. That’s a promise about behavior. Fintra enforces the floor inside the aggregation itself - a stronger guarantee, because the small-group number simply does not exist to be leaked. For a survey, where candor depends entirely on trust, that difference is the whole point.
Frequently asked questions
What is k-anonymity in a survey?
It’s a floor on how small a reported group can be. With k=3, any driver, team, or manager cut answered by fewer than three people is suppressed - the aggregate for that group is never computed - so an individual’s answer can’t be isolated.
What happens to a team too small to report?
Its cell shows “suppressed (n<3)” and its responses roll up only into larger aggregates like the org-wide score. No one can drill into a below-floor group, so a two-person team’s answers stay unattributable.
How is this different from Culture Amp or 15Five?
Those tools protect anonymity by policy and apply minimum-response thresholds at display time. Fintra enforces the k-anonymity floor inside the computation itself, so the small-group number never exists to be exposed in the first place.
Is the driver analysis a black box?
No - driver correlation is deterministic. The same responses always yield the same ranking of what moves eNPS, so you can act on the top driver without worrying that a re-run would reshuffle it.
Can I keep years of survey history?
Honestly, not yet as a durable system-of-record - the survey engine currently runs in-process on a non-durable store. It’s a working product for running and reading pulses today; long-horizon retention is a roadmap item, and we’d rather say so.
Stay in the loop
One practical finance briefing a week - new guides, checklists, and benchmarks.
One brain for people, work, and money
See humans, AI agents, support, and finance decisions in a single governed workspace.
Talk to us