Anonymity and minimum N

Anonymity in Censuma is not a configuration option that can be switched off. There are two distinct mechanisms, and it is worth not confusing them because they protect different things.

One: the response is not tied to the person

Who responded and what they responded are stored with no relationship between them. It is not a denied permission or a value hidden behind a role: the link does not exist in the database.

That means the product can tell you Juan has already responded —you need that to chase participation— and it cannot tell you, or us, what he answered. The response date is also stored without a time, so the two ends cannot be rejoined by the order in which they arrived either.

This comes before everything else and does not depend on the threshold: even with ten thousand responses in a study, there is still no way to recover one person's answers.

Two: the confidentiality threshold

The second mechanism protects small groups. A result from three people is technically anonymous and practically is not: if you know who the three are, you already know a lot.

The confidentiality threshold (also «minimum N») is the number of responses a group needs before its results can be published. It is one number per organization.

Who sets it, and when it starts to apply

The account owner sets it, and everyone can see it: you need to see it to understand why something is not being shown.

Every study freezes the threshold in force when it was created. Raising or lowering it today rewrites nothing backwards — it applies to studies created from now on. That is what keeps a result published last year from changing state because of an administrative decision this year.

Where it applies

Everywhere a result could be exposed, not just in the main one:

• The result of a node with few responses.
• A segment built with filters, even when the whole node does clear the threshold.
• A category inside a result that clears it in total.
• A point in a historical series, which is drawn as a gap instead of being joined by a line.

With filters by position, sex, age or tenure: publication groups

A demographic filter carries a risk of its own: two filters that each clear the threshold can be subtracted from each other. «The women in the area» minus «the women in one position» can leave a single person, even though neither result is small.

That is why, when a study is finalized, the responses of each area are split into groups of at least N people, and a filter by position, sex, age or tenure publishes only the groups that fall entirely inside it. Combining, adding or subtracting filters never leaves fewer people than a group, no matter how many queries are made or who makes them. The groups are built once, without looking at anyone's answers, and they do not change afterwards.

When some people in the filter ended up in a group mixed with others (for example, the only person in a position in their area), the result is still shown, marked as «Partial coverage», and it does not include them. The mark never says how many people are missing or where they are. When one exists, the product offers the smallest filter that does come out complete, such as two positions together.

Results are published when the study is finalized

While a study is in progress you see how collection is going, not the results. If they could be read live, comparing the result before and after one person finishes, with the participation list beside it, would reveal that person's whole questionnaire.

Why the notice is always the same

When something is hidden, the product says it cannot be shown and does not say which of the reasons applied. This is deliberate, and it is the piece of the design most often mistaken for lazy copy.

The reason is information about the hidden group. «This segment has fewer than N responses» and «this segment can be deduced from the one next to it» say different things about how many people are in there. A different message per cause rebuilds, in prose, exactly the channel the threshold closed in the data. The «Partial coverage» mark follows the same rule: it is always the same text.

It sits above permissions

This is the one rule in the product with no exception by role. Nobody sees a hidden result — not the account administrator, not the owner, not us.

It is not a posture: it is the condition for the instrument to work at all. A climate survey measures what people dare to say, and that depends entirely on the promise being true in every case rather than in almost every case.

What you can do about it

If a lot of results come out hidden, it is almost always a design question, not a technical problem:

• Look at the shape of the tree. Branches with very few people produce results that will never be readable. See The org tree.
• Segment more coarsely. Crossing node × sex × age × tenure all at once splits the sample into tiny cells. Drop one axis, or put two options of an axis together, and the data appears complete.
• Check participation before the threshold. Sometimes the group is large enough and what is missing is responses.