A compensation survey platform with k-anonymity, by design

Polls vs survey peer groups

Most survey tools combine two things into one: the questions being asked, and the group of people answering them.

Salary Confidential separates these concepts.

• A poll defines the question set - the topic you want to understand
• A survey peer group defines who is answering - the specific subset of respondents you invited

Each peer group answers the same poll, but through its own survey link. This means responses remain anonymous, while still preserving the context you defined when you created each group.

A useful way to think about this is as running the same interview in multiple rooms. You decide who enters each room. Once inside, responses are anonymous - but you still know which room each response came from.

This gives you two complementary views:

• A poll-level view, where all responses from all survey peer groups are combined - this is equivalent to what a traditional survey tool would give you
• A peer group view, where each subset can be analyzed independently

Preserving context and precision without exposing individuals

In traditional surveys, adding contextual information like location, organization type, or team directly to responses can make individuals identifiable, even if names are removed. This risk increases quickly as groups get smaller.

Salary Confidential avoids this by not attaching sensitive attributes to individual rows.

Instead, context is expressed through peer groups.

If you want to understand compensation in a specific location, or within a specific type of organization, you create a peer group for that subset. As long as that group reaches the minimum required size, you can analyze it safely, without ever exposing who said what.

This allows you to keep the dimensions that matter, without turning them into identifiers.

Modeling surveys and results to prevent re-identification

Salary Confidential also reduces re-identification risk through how surveys are designed and how results are presented.

Our survey forms are intentionally constrained and carefully modeled. When we collect sensitive information, we do not expose it back in ways that could be traced to an individual.

Some of the ways we do this include:

• We collect precise inputs, but present them through blended metrics that are often more informative than raw values, without being legible back to any single input.
• We collect sensitive information, but do not join it back to individual response rows. For example, if you collect location, we may show that "respondents include locations such as X and Y", without attaching location to any specific result.
• In some cases, we introduce mathematical noise and controlled randomization within defined boundaries to make tracing impossible while preserving overall signal. This is how we handle company size.
• Finally, when a result would still create an unsafe situation, we suppress that element entirely for that specific survey group.

Minimum group size: k = 4

Every survey peer group must have at least 4 responses before results are shown.

This enforces a practical level of k-anonymity:

• No individual response can be isolated
• Each data point is always part of a group of at least four peers

Within that constraint, you are free to define highly specific peer groups, by role, organization type, geography, or any combination that matters for your analysis. You can use it to detect inequity and social pay gaps too.

Result release is also designed around k-anonymity

Protecting respondents is not just about what data is shown, but also when it is revealed.

Salary Confidential releases results in controlled batches, so that no individual response can be inferred from timing. Results are only made visible once they are part of a sufficiently large group, and we prevent exposing partial batches that would fall below our safe thresholds.

This means that even if a survey is still in progress, or closes early, results are only ever shown in a way that preserves anonymity across the full lifecycle of the survey.

Anonymity is about the data, not just the person

Many tools promise anonymous surveys because they do not collect names.

But anonymity can break down through the data itself. A single response with unique characteristics can still be traced back to an individual.

Salary Confidential addresses this at the system level:

• By structuring how respondents are grouped
• By limiting what can be captured at the individual level
• By enforcing minimum group sizes before any data is visible
• By controlling how and when results are released

The result is a system where you can ask precise, high-context questions, and still protect every participant.