Why people tell you the truth.

Performix earns the promise two ways. First, raw identities never enter the analysis: every person becomes a stable, meaningless token — think tk_9f3k2 instead of “Maria in Accounts.” The same person always maps to the same token, so you can still track trends over time, but the token can't be turned back into a name.

Second, no result is ever shown for a group small enough for a reader to guess who said what. If only one or two people answered, the system shows nothing rather than a number. The two parts together — tokenize, then gate — are what make anonymity structural rather than a label.

Exit data — who's quitting, and to whom — is the single most sensitive and most valuable signal there is. This is the from-to view for one demo engineering segment: the employers you win talent from, and the ones you lose it to. Nine key-talent exits, six of them regretted — a 67% regretted-attrition rate.

Six of those leavers went to Competitor-A, citing pay and growth — a clear, actionable pattern. Five new hires came from Competitor-C, citing culture and comp. But look at Competitor-B: so few leavers went there that naming a count could expose an individual, so with a minimum-group-size floor of 5, the cell renders honestly as suppressed rather than showing the real (tiny) number.

Note the discipline: where a real number would identify someone, you get an honest gap — not a fabricated or rounded-off figure standing in for it. The system would rather show a blank than a clue.

Most tools treat “anonymous” as a checkbox on a survey form — anonymous in name only; anyone who has worked somewhere can often guess who wrote what. Performix treats it as a measurement primitive handled by a dedicated service (mocked in this demo, swapped for the live service when it deploys).

Two parts. Deterministic tokenization: the same person always maps to the same meaningless token, so trends over time work, but the token can't be reversed into a name. And a hard minimum-group-size gate that runs before any summary is allowed to render — the gate is structural, so when a group falls below the floor the surface shows a “below threshold” state and no numbers cross the boundary at all.

Because it's a shared service, the same guarantee protects every insight in the product, not just one screen. That is the difference between reducing re-identification risk to engineering-grade and merely promising it on a form.

The privacy contract — deterministic (HMAC) tokenization, min-N gates, suppression rules — is the design primitive beneath every Performix surface, and the suppression behavior is what you see rendering on the seeded demo data today. Performix's anonymization and response-collection run the same privacy guarantees end-to-end; when live data is connected, the same surfaces light up on real data with no UI change.