Every conversation about salary benchmarking arrives, sooner or later, at the same question: "what happens to our data?" It is the right question. Salary data is among the most sensitive information an organisation holds, and in jurisdictions built on financial services, trust in how data is handled is not a nice-to-have. It is the product.
So here is how it works, plainly.
From contribution to benchmark
1. Your data arrives through a controlled route. Salary data syncs from your HR system (HiBob, Breathe HR, Access PeopleHR, Sage or YouManage) or arrives as a CSV upload. Either way it lands in your organisation's own space, visible to your authorised users and nobody else.
2. Roles are matched, not exposed. PayPulse matches each role to a job family and level so that comparisons are like for like. Matching is about the role, never the person.
3. Anonymisation happens before aggregation. When data contributes to the market pool, identifying detail is stripped first. What enters the pool is salary information attached to a role, a level and a jurisdiction, not to a person or an employer.
4. Benchmarks are computed from the aggregate only. Every number you see in PayPulse, every percentile, every distribution curve, is calculated across the aggregated pool. No organisation ever queries another organisation's records, because the benchmark layer simply does not contain them.
The suppression rule
Aggregation alone is not enough in a small market, and the Channel Islands are a small market. If only a few people hold a role at a level, even an aggregate could gesture at an individual.
That is why PayPulse suppresses small groups automatically. Where a cell of the analysis falls below a minimum headcount, it does not render. Not blurred, not approximated: absent. You will occasionally see a suppressed cell in your own reports. That is not a gap in the product. It is the product, doing exactly what it promises.
What never comes back out
Some things are simply not possible in PayPulse, by design rather than by policy:
- No user can see another organisation's salary records, in any view, at any permission level.
- No benchmark can be traced back to a person or an employer.
- Small groups never render, so outliers cannot be inferred from a thin slice.
Why contribute at all?
Because the benchmark is the pool. Every organisation that contributes sharpens the picture for everyone, including itself: benchmarks are refreshed periodically as new data arrives, so the market view improves as participation grows. You get out a clear view of a market that is otherwise opaque, and what you put in is protected by the architecture described above.
If you want to go deeper, our privacy notice covers data handling in full, and we are always happy to walk your compliance team through the detail. That conversation tends to be short. The design answers most of the questions before they are asked.