How Salary Confidential protects respondents' privacy

You always know who is asking — and why

Salary Confidential does not allow anonymous requesters.

Before someone can invite peers to a survey, they must verify:

• Their LinkedIn profile, by placing a unique identifier in their bio (this profile is then locked to their account)
• Their professional email address, via confirmation email (any change requires re-verification)

Requesters cannot match people to data points

While a requester knows who they invited, they cannot determine who submitted which response.

This is enforced structurally, not by policy:

• Surveys must be created with at least four intended respondents
• Results are only released once a minimum threshold is reached
• Results are never released in batches smaller than three
• Partial or incremental release that could isolate one or two respondents is not allowed

This creates deliberate uncertainty around participation and timing, preventing a requester from reconstructing which peer contributed which data point — even in small, well-defined groups.

Invitations are precise — but untraceable

Survey access is controlled by single-use invitation tokens, issued by the requester to specific peers.

These cryptographic tokens guarantee that:

• only the intended peer group can respond
• no one outside that group can submit data into the survey

At the same time, the tokens are designed to be untraceable:

• the requester cannot tell whether a specific token was redeemed
• Salary Confidential itself cannot link a redeemed token to a specific response

We deliberately treat our own platform as a potential point of accidental leakage — and engineer it so that tracing data simply does not exist.

We collect as little about you as possible — and keep it isolated

We are intentional about both what we collect and where it lives:

• Respondent data is limited to what is necessary for the survey
• Operational metadata used for security or abuse prevention is never exposed in reports
• Public survey results are generated from a data surface that does not include internal audit or access metadata
• Surveys are protected against indexing, scraping, and automated collection

Even if someone were to access a survey report directly, the information required to reconstruct identity or participation is not present.

Privacy by construction, not cleanup after the fact

Rather than relying on anonymization after data collection, Salary Confidential builds privacy protections directly into:

• question design
• data structure
• result presentation
• release timing

This reduces the risk of accidental identification before results ever exist.

Why this matters

Compensation data is sensitive, and professional circles are small.

Even when names are hidden, subtle signals — timing, ordering, overly specific detail — can be enough to identify someone. Salary Confidential is designed to prevent those signals from lining up in the first place.

That's what allows respondents to contribute candidly, and in turn for all parties to learn useful, precise information — without compromising trust.