Are employee engagement / pulse surveys really anonymous, and can my employer see who said what?

An anonymous survey collects nothing that ties a response to a person, while a confidential survey does link your response to your employee record and then restricts who can see it and at what level of detail. Lattice puts the split in one line: "Anonymous means you don't know who said what. Confidential means you know who said it, but you're not going to disclose that information" [4]. Almost every engagement and pulse product sold to employers sits on the confidential side, because that link is what makes it possible to break results out by department, tenure, manager, and location.

Vendors often say anonymous and mean confidential

Culture Amp is unusually direct about this. Its documentation states that Culture Amp surveys "are not anonymous" and that "We prefer to communicate that Culture Amp surveys are 'Confidential'" [1]. In its attributed format, "Each response is linked to an employee in your account through the users profile" [1]. Microsoft Viva Glint runs two survey classes, confidential and identifiable, with a different response threshold on each [8].

What each type means for you in practice

Under a confidential setup the tool knows the answer came from you, so your protection is a reporting rule rather than an absence of data. Culture Amp's participant guide states "We do not display individual responses" and explains that people with access to results can only see demographic groups meeting the reporting minimum set for the survey [2]. That works well inside a group of any real size, and less well on a five person team or in a filter combination that only one person matches.

A genuinely anonymous survey is recognizable from the moment you open it. Culture Amp describes its unattributed format as one where responses have "no connection to any specific individual" [1], which means no personalized link, no name prefilled, no reminder singling you out, and no demographic fields beyond the ones you type yourself. Technical anonymity also depends on the platform discarding network metadata, which is a setting rather than a default in general purpose survey tools [10][11].

A reporting threshold hides a group's results until enough people in that group have responded, so a manager with a small team sees a blank rather than a score. Culture Amp defines the reporting group minimum as "the smallest number that you can filter down to in reporting" [3], and its participant guide sets the bar at "at least 5 responses have to be submitted within any filtered group" [2]. Viva Glint uses the same default of five, adjustable down to three or four [7].

A second layer stops people doing the arithmetic

Hiding one small group is not enough, because a viewer can work out the hidden number by subtracting the visible groups from the total. Culture Amp names this: "Indirect identification occurs when the responses of an individual, or small group are hidden, but their score can still be worked out by looking at the other scores around them" [3]. Its Strong setting also hides the next smallest group whenever a filter includes a group under the reporting minimum [3], and Viva Glint does the same through a suppression threshold set to two by default [7].

Crossing filters is where thresholds get tested

Combining two or three demographic filters shrinks a group quickly, and a slice such as women in engineering with more than ten years of tenure at one site can land on a single person. Viva Glint answers that with filter suppression, which stops users isolating groups that should be suppressed through report filtering, and with a higher minimum of 10 for scores and 20 for comments whenever someone filters by a question response [9].

Small teams get thinner protection

Workleap Officevibe shows where the floor sits: scores "are not visible until at least three (3) active members have answered the survey," and anonymous feedback becomes visible once "a Team has at least five (5) members" [6]. On a team of five where four people respond, a three response threshold gives the manager an average built from a handful of answers, and one strongly negative rating moves it enough to be noticed.

Free text comments carry more identification risk than any rating question, because a comment can name a project, a meeting, or a person, and because your writing style is recognizable to colleagues who read your messages every day. Culture Amp tells participants this outright: "Confidential surveys do not identify comments. However, it's naturally possible to identify yourself by the content of your comment. If you'd like to remain confidential, do not include identifying information such as people's names or departments, and be careful to use generic language" [2]. Microsoft Viva Glint puts the same warning inside the confidentiality statement employees see before answering: "Write-in comments are reported verbatim if at least 10 people respond to a question. Take care not to identify yourself in the comments" [8]. Verbatim is the operative word: a complaint about a specific incident points at whoever was in the room, whatever the threshold.

Survey links tell the platform who you are

A personalized link is the mechanism that makes a confidential survey confidential. Culture Amp's attributed surveys use unique survey links to track responses to specific individuals [1], which is what allows reminders and demographic breakouts. An open link anyone can use, with nothing prefilled and no completion tracking, points toward an unattributed setup [1].

Metadata is collected whether or not anyone looks at it

Survey tools record more than your answers. SurveyMonkey web link collectors "record the IP addresses of respondents by default," and switching on anonymous responses only affects new submissions, since "it's not possible to make existing responses anonymous" [11]. Qualtrics offers an Anonymize Responses option that removes "the respondents' IP address, location data, and all other default Qualtrics fields" [10]. Timestamps, device details, and custom variables passed through the link ride along unless somebody turns them off, which is why SurveyMonkey warns creators against identifiable custom variables when anonymity is the goal [11].

Some administrators can, depending on how the account is configured and which survey you are answering. Microsoft Viva Glint publishes two default confidentiality statements, and the version used when an organization approves raw response export tells employees: "A limited number of people at [Organization Name] will have access to your identifiable survey responses" [8]. If that sentence appears before you answer, individual level access exists inside your employer. 15Five draws a different line, stating that no individual responses are visible to managers or leaders on engagement surveys, while noting those rules do not cover Lifecycle surveys, which do expose individual responses to account admins and permissioned managers [5].

What vendors actually commit to

Vendor commitments cover reporting rules and configuration options rather than a guarantee that no human being can ever see a row of data. One durable safeguard is timing: Viva Glint admins can only adjust survey level thresholds before a program launches its first survey, so the rules cannot be quietly loosened once responses exist [7].

General information about legal protection, not legal advice

Survey responses in the United States have no dedicated statutory protection, so a confidentiality promise is generally an employer policy plus a contract between your employer and the vendor rather than a right you personally hold. One protection that can apply is the National Labor Relations Act's coverage of protected concerted activity, which the National Labor Relations Board describes as employees acting together to address work related issues, including "talking with one or more co-workers about your wages and benefits or other working conditions" [14]. A single employee can also be covered while acting on behalf of coworkers or bringing a group complaint to management, though the protection can be lost where conduct is "egregiously offensive or knowingly and maliciously false" [14]. Whether a particular survey comment qualifies depends on the facts, so treat this as general information and raise your own situation with an employment lawyer or your regional NLRB office.

Ask which of the three survey types you are taking, what the reporting minimum is, and who can see comments. Those three answers account for most of your real exposure, and any employer running a major platform can state them, since Viva Glint shows a confidentiality statement at the start of every survey covering that ground [8].

Questions worth asking in writing

• Is this survey anonymous or confidential in the vendor's own terminology? Culture Amp, 15Five, and Viva Glint use those words with specific technical meanings, and the answer tells you whether your identity is stored at all [1][5][8].
• What is the minimum number of responses before a group's results display, and did we keep the vendor default? Lattice defaults to five and permits three [4], and 15Five defaults to five and permits three or four [5].
• Is there a separate, higher threshold for comments? Viva Glint's default is 10 responses, rising to 20 when someone filters by a question response [7][9].
• Can anyone here export raw individual responses [8], and is filter suppression switched on so a viewer cannot isolate a group small enough to identify [9]?
• Who administers the account, and does that person report into the leadership chain the survey is measuring?

Signals that the setup is weaker than advertised

A survey that arrives as a personalized link, greets you by name, or chases you with reminders for not finishing is attributed, whatever the invitation email calls it [1]. A survey that asks for department, level, tenure band, location, and manager on a team of twelve has collected enough to narrow you down, which is the effect SHRM described in reporting that details such as department, title, salary level, and years of service can be enough to let a company know who responded and how [13]. If nobody will tell you the reporting minimum, treat ratings as reasonably safe and comments as attributable.

It is not a legal shield or a guarantee

A confidentiality promise is an employer policy and a platform configuration, and the National Labor Relations Act protects concerted activity about working conditions rather than survey responses as a category [14]. SurveyMonkey warns creators that even with anonymous settings enabled "the questions you are asking could identify a person in any case," and recommends describing those surveys as "confidential," "pseudonymous," or "partially de-identified" instead [12].

It is not consistent across every survey your employer runs

Engagement, pulse, onboarding, and exit surveys often run on different settings inside the same product. 15Five's confidentiality rules cover engagement surveys but not Lifecycle surveys, which expose individual responses to account admins and permissioned managers [5]. Viva Glint sets the minimum threshold for an Employee Lifecycle or always-on survey at one response [7].

It is not a reason to assume the worst

The default configurations these vendors publish do hide individual rating answers behind group minimums of three to five responses, and several hide comments behind a higher bar again [4][5][7]. Inside a group of reasonable size, an honest rating is well protected. The risk concentrates in free text comments, in very small groups, and in the survey types your employer has deliberately made identifiable.