A team average is a disguise, and small groups make thin disguises. With three respondents, anyone who knows their own answer and one colleague's mood can often deduce the third's, the "small cell" problem that statistical disclosure control has studied for decades (Hundepool et al., Handbook on Statistical Disclosure Control, ch. 5 on frequency tables). UK official statistics treat small cells as disclosive as a matter of routine: the Government Statistical Service's guidance for survey tables says plainly to "suppress or combine unsafe cells, i.e. where there are one or two units contributing to the cell" (GSS/GSR disclosure control guidance).
The legal frame agrees. The ICO's anonymisation guidance tests identifiability against "all the means reasonably likely to be used, such as singling out" (ICO, How do we ensure anonymisation is effective?). In a workplace, colleagues' background knowledge, who was on leave, who has been struggling, is always a means reasonably likely to be used. A three-person "anonymous" average fails that test on any ordinary working day.
Five is where single-insider deduction stops being trivial, because a respondent who knows their own answer still faces four unknowns. It sits above the GSS "one or two units" definition of an unsafe cell with margin for the insider problem, and it is the most common default in employee-survey vendors' own documentation, usually stated rather than justified. Some vendors publish a lower number, and several let an administrator lower the default. The table below lists what each vendor publishes.
Two caveats apply. First, repeated cross-tabulation (team by tenure by site) can rebuild small cells from individually compliant queries, so the floor must apply per displayed cell, not per query. Second, for severe-distress screening measures five is not enough, because the stakes of a correct guess are higher, so the Open Workplace Health Standard applies n ≥ 10 to those, and this engine implements that as a second schema constraint.
Almost every tool implements its threshold in application code: an if statement decides whether to display the number. The number itself exists, in the database, in exports, in whatever an "enterprise data access" feature or a support engineer with production access can reach. The promise is one product decision away from broken.
The structural alternative, verbatim from this engine's schema:
constraint aggregates_firewall check (
(not suppressed and n >= 5 and value is not null)
or (suppressed and value is null and ci_low is null and ci_high is null
and sd is null and suppression_reason is not null) )
A below-threshold average is unrepresentable. The database rejects the row; no privileged query, export flag or admin override can return a number that was never stored. What is stored, deliberately, is the fact of withholding and a coded reason (below-floor, safeguarding, low-completion, from the OWHS suppression-reason codelist), so a dashboard can say honestly "withheld to protect anonymity". A blank would invite guessing.
aggregates_firewall CHECK constraint on the iwe.aggregates table, created in migration 0001_iwe_reference_core.sql. A shown result needs five or more respondents and a value. A withheld result must have no value, no interval, no standard deviation and a reason.below-floor and no value for any group under five, so the constraint backs up the computation.severe_floor CHECK constraint, n ≥ 10, in migration 0004_deep_dive_admin.sql.0018_org_only_units_and_no_invented_bands.sql).GET /aggregates reads the same table and has no parameter that bypasses it. Withheld rows are returned with their reason.In privacy research this idea is called k-anonymity. A release is k-anonymous when each person in it cannot be told apart from at least k−1 others in the same release (Sweeney, 2002). The IWE's floor is a k-anonymity-style threshold with k = 5, so no stored figure rests on fewer than five people. It sets a minimum group size for each figure and does not make the whole set of results k-anonymous in the formal sense.
The floor applies to each stored result, and we have not built a check against differencing, where someone compares two results over time to infer a change in one person. Keeping organisations whole makes that harder but does not rule it out.
What each vendor's own public documentation says about the fewest respondents a survey result can rest on. We checked every page on 28 September 2026 and quote the vendor's words. Where a vendor lets administrators change the number, we say so. A vendor missing from this list either publishes no number we could find or blocked our check.
| Vendor | Published minimum | Can it change? | Source |
|---|---|---|---|
| FeedbackPulse | 3 | Described as "a platform-level anonymity threshold of 3 responses" | Anonymous surveys |
| Lattice | 3 | Admins can raise it per survey; "it can never be less than three respondents" | Anonymity in engagement surveys |
| Workleap Officevibe | 3 for survey scores; 5 for anonymous feedback | Not stated | Officevibe anonymity |
| Perceptyx | 4 | Not stated | FAQ |
| Microsoft Viva Glint | 5 for scores (default); 10 for comments | Scores "can be adjusted (to as low as three responses.)" | Manage confidentiality thresholds |
| 15Five | 5 (default) | Admins "can lower this to 3 or 4" | Engagement survey confidentiality |
| Culture Amp | 5 (default for "most surveys") | Configurable; its checklist recommends 3 for smaller organisations | Demographic data, pre-launch checklist |
| Qualtrics EX | 5 (default, for data points and comments) | Configurable | Confidentiality overview |
| CultureMonkey | 5 (default) | Set "per survey and per team" | Anonymous feedback tool |
| Effectory | 5 | Can be raised; "five being the absolute minimum" | Confidentiality and respondents |
| Workday Peakon Employee Voice | No default stated | Set by the administrator; the documentation gives examples only | Confidentiality and data visibility |
| Intelligent Wellbeing Engine | 5; 10 for severe-distress counts | No. It is a database constraint, and weakening it breaks the licence | This page |
The interactive demo lets you shrink a simulated team below five and watch the value cease to exist, including the stored reason. For small groups above the floor, the companion page covers the other half of honesty: confidence intervals for small-team scores. The full set of constraints is stated in the honesty rules.