Honest answers need a safe place to land.

The short version

• Your organisation never sees your individual answers.
• Every number comes from at least 5 people.
• Comments become themes, with names taken out.
• Nobody sees when you answered or how long you took.
• Your answers are encrypted, then deleted on a fixed timetable.
• Liberty Mind checks every report before it's released.

We call the survey confidential, and we choose that word carefully. Your organisation can see who has completed it (that's how reminders work), so we don't pretend nobody could ever know you took part. What we promise is that your answers can't be picked out, and we've designed every screen, report and email around that.

The 5-person rule

A report is only produced when at least 5 people have answered, not counting the organisation's own admins. If fewer than 5 take part, the survey closes without a report and nobody sees any results.

The same rule applies to every score inside the report. Each of the eight topics, and each statement, is only shown when at least 5 people answered it. Otherwise the report says "Not enough answers to show safely" in its place.

If a co-admin (someone who can see the report, such as an HR lead) also answers the survey, the bar goes up by one for each of them. That way there are always at least 5 other people behind every number they see, and they can't work backwards from their own answers.

Small teams and larger teams

The fewer people who answer, the less detail we show. There are two modes, chosen automatically.

There are no breakdowns by team, level or length of service. Slicing results into smaller groups is exactly how individuals get identified, so we don't do it.

Comments

Every comment box is optional, and each takes up to 500 characters. We ask people not to name anyone or share health details. Here's what happens to what they write:

1. Names of the people invited, the organisation's name, email addresses and phone numbers are taken out automatically.
2. An AI service then masks any names or one-of-a-kind job titles that are left, and groups the comments into themes for each topic. It only ever sees text that has already had names taken out.
3. A theme is only reported if at least 3 different people contributed to it.
4. Liberty Mind reads every theme before the report is released, and can edit or merge them.
5. Your organisation sees the themes (and, in standard mode, a couple of lightly reworded excerpts). Never the comments as written.

If a comment describes something serious, such as harassment, discrimination or a risk to someone's safety, it's left out of the report and Liberty Mind follows a written process to decide what to do. That's the one limit to confidentiality we can't design away, and we'd rather tell you now than surprise you later.

If your organisation chose the Debrief, a Liberty Mind consultant reads the comments with names taken out, and never passes them on word for word.

Who sees what

"Your organisation" means the account owner (usually the founder) and any co-admins they've added. Your own answers stay in your browser tab until you send them.

What we deliberately leave out

Some of the most important protections are things the app simply doesn't do.

• No "started" status and no timestamps. The dashboard shows each person as Completed, Not completed or Bounced, nothing more, so your organisation can't line up a completion with an answer.
• No near-identical re-runs. If two surveys invite almost the same people (the lists differ by only 1 to 4 people), the second one can't be sent. Comparing them could reveal how those few people answered. The same organisation also has to wait 90 days between surveys.
• Results are worked out once. When a survey closes, no more answers can be added and it can't be reopened.
• Answers are shuffled when the survey closes. They're separated from the links they came from and encrypted again, so the stored order says nothing about who answered when.
• No emails to you after you answer. There's no thank-you message to spot or forward, and nobody at your organisation is shown when you finished.

How long we keep things

Answers and comments

Deleted 90 days after the report is released, or 30 days after the survey closes if there's no report.

The list of who was invited

Deleted on the same timetable.

The report

Kept while the organisation is a customer, plus 2 years. It only holds combined results and themes.

Research answers (if you opt in)

Released for research once answers from at least 3 organisations are pooled; deleted after 12 months if that never happens.

Backups

Our platform keeps 7 days of backups, so a deletion becomes final 7 days later.

The research pool

At the end of the survey there's an optional box: "Allow my answers, with no link to me or my organisation, to be used to improve this diagnostic." It's unticked unless you tick it, and it makes no difference to your organisation's report.

• Only answers to the 40 statements go in. Never comments, never email addresses, never the organisation's name.
• They're stored with just the organisation's size band, the question set version and a rough time taken.
• They're only released for research once answers from at least 3 organisations have been pooled, and then all together in a shuffled batch, so nothing points back to one organisation.
• Unlike survey answers, they aren't encrypted, because they hold nothing that identifies you. Until they're released, the date they were added could match them to a survey; that date is dropped on release.

Questions