Data Security & Anonymity

Anonymity is the architecture. Not a promise.

SentimentIQ™ only works if employees answer honestly, and employees only answer honestly when the system itself makes identification impossible in reporting. This page describes exactly how response data is collected, protected, reported, and retired.

How Responses Stay Anonymous

Anonymous by design, at the system level.

Anonymity in SentimentIQ™ is not a policy statement layered on top of an ordinary survey. It is built into how the system is structured.

Access

Randomized access codes

Each employee receives a unique, randomly generated access code. No email address, login, or app download is required to respond. The code confirms that a response came from an eligible employee. It does not attach a name to what was answered.

Separation

Participation and responses are kept apart

The record that a code was used is stored separately from the responses themselves. Leadership can monitor participation rates during the survey window without any path to individual answers.

Reporting

No individual is ever scored

SentimentIQ™ measures workforce-level conditions. No individual employee is scored, identified, or identifiable in any report, dashboard, or deliverable, and results are never used for discipline or individual employment decisions.

Roster handling

Roster data is used once, then restricted

Client rosters are used solely to size the deployment and generate access codes. Roster files are held in restricted storage, are never joined to response data in reporting, and are covered by the same retention policy as responses.

8Respondent floor

No results are reported for any group smaller than eight respondents. If a department, shift, or supervisor cut would fall below the floor, it is rolled up into the next larger group. This is how SentimentIQ™ delivers supervisor-level resolution without ever compromising the anonymity that makes the data honest in the first place.

Data Handling Policies

Who can see what, and for how long.

Raw data access
Raw response data is accessible only to named, authorized Blue Sky Analytics principals. Clients never receive raw responses, under any circumstances or by any request. This is not only an ethical boundary. It is a methodological one: employees answer honestly because they know their employer will never see individual answers. Removing that guarantee would destroy the accuracy of the data the client is paying for.
Client deliverables
Clients receive aggregated reporting only: dimension scores, department and shift breakdowns above the respondent floor, risk rankings, root cause findings, and roadmaps. Nothing in any deliverable can be traced to an individual.
Retention
Raw response data and roster files are retained for 12 months from the close of the engagement, then deleted. The 12-month window exists for one reason: clients who re-assess within a year receive trend analysis against their baseline at a substantially reduced engagement cost. After 12 months, only the aggregated findings already delivered to the client are preserved.
Storage & encryption
Response data is stored on Google Workspace infrastructure with sharing restricted to authorized accounts protected by multi-factor authentication. Data is encrypted in transit and at rest by default on this infrastructure.
Subprocessors
No response data is sold, shared, or transferred to any third party. Blue Sky Analytics does not use response data for any purpose other than the engagement it was collected for.
Counsel review
The SentimentIQ™ survey instrument has been reviewed by labor counsel.
What Employees See

Transparency is part of the methodology.

Honest data requires informed participants. Every deployment includes a privacy notice shown to employees before they begin, and a launch communication the employer sends when the survey window opens. The standard language for both is published here in full.

Sample · Employee Privacy Notice

Shown to every employee before the first question

Your responses are anonymous. This assessment is run by Blue Sky Analytics, an independent firm. Your employer will never see your individual answers, and neither will your supervisor, HR, or anyone else at your company. They receive only combined results for groups of eight or more people.

The access code you received was generated at random. The system records that a code was used separately from what was answered, so no name is connected to any response. Your answers are never used for discipline or for any decision about any individual person.

Answer honestly. That is the entire point. Raw responses are deleted within 12 months.

Sample · Survey Launch Communication

Sent by leadership when the survey window opens

Team, starting today you will receive a personal access code for a short, anonymous workplace assessment. We have engaged an independent firm, Blue Sky Analytics, to run it because we want to know honestly how things are going here, what is working and what is not.

This is anonymous by design. We will never see individual answers, only combined results for groups of eight or more. The independent firm holds the responses, not us. Nothing you say can be traced to you, and nothing in this assessment will ever be used in any decision about any individual person.

It takes about ten minutes and can be completed on your phone, on any shift, over the next two weeks. We are doing this because your experience here matters and we intend to act on what we learn. Please be candid.

Questions about deployment or anonymity?

We walk through the full protocol, including how the respondent floor and data separation work in practice, in a confidential 30-minute briefing.

Request a Confidential Briefing