Privacy: hiding and rounding

Platform data, not official statistics. The rules below apply to every figure for universities and government bodies. No setting can relax them, not even for small pilot cohorts.

The Platform's statistics must never reveal anything about a specific person. So small groups are hidden, numbers are rounded, and every computation passes all checks before its result is written. Raw small numbers are never stored anywhere.

The threshold: 10 people

• Any number below 10 is hidden and shown as "<10".
• When a figure is hidden because the group is small, the Platform says how many more confirmed students are needed to unlock it, instead of showing an empty chart.
• The threshold is set in code (K_MIN = 10) and cannot be changed by server settings.

Complementary suppression

A total is the sum of its parts. If only one part were hidden, it could be worked out by subtracting the others from the total. So:

• in every "total — parts" group there can never be exactly one hidden part; if there is one, another is hidden too, the smallest of the visible ones;
• the hidden parts together must add up to at least 10 people;
• the check is repeated across all related breakdowns until nothing changes.

This way no hidden number can be recovered from the published totals, even allowing for rounding.

Rounding to 5

• All counts are rounded to the nearest multiple of 5. Suppression decisions are taken before rounding, on exact numbers.
• Because of rounding, the parts may not add up exactly to the total. That is expected.

Shares

• A share is shown only when its denominator is at least 10. It is computed from its numerator and its denominator, each rounded to 5 like every count, and rounded to a whole percent: a share never tells more than those two rounded numbers.
• When the numerator rounds to 0 (fewer than 3 people), the exact share is not shown: a band "under p %" is shown instead, where p is the share 3 people would give of the rounded denominator, rounded up to the next 5 % ("<5 %" from 60). When the numerator rounds to the denominator, the band "over q %" is shown, q being the lowest share the rounding allows, rounded down to 5 % (">60 %" for 10, ">75 %" for 20, ">95 %" for 100).
• A share is hidden wherever its numerator or its denominator is hidden.

Medians, quartiles and distributions

• A median is shown with at least 10 observations; quartiles with at least 20.
• The readiness score is shown as a whole number; salaries rounded to 100,000 soums.
• Each interval of a distribution is a count and follows the same rules.

The dominance rule

Figures about companies (salaries and demand for skills) follow an extra rule: such a figure is shown only when at least 3 organizations stand behind it and none of them accounts for more than 50 % of the cell. Otherwise it is hidden, so that the statistics cannot reveal one company's data; the cell's other numbers, such as those about students, stay.

A university's partner figures (how many of its students applied to a company and how many of them were hired) are about one company by definition. They are published only for companies that confirmed the partnership with the university themselves, and they follow the general rule of at least 10 students.

Fixed breakdowns only

Figures are built only for predefined breakdowns (listed in the cohort methodology). Requests with arbitrary filters are refused: by comparing two overlapping requests one could work out a hidden small number.

Published computations

• Every night the computation runs in memory: numbers are computed, suppressed and rounded, and only then written.
• A published computation is immutable. It carries the methodology version, the program version and a checksum.
• A new computation replaces the previous one as a whole; replaced computations are kept for 90 days.
• The statistics pages and the government cabinet read only published cells, through a database account that has no access to data about people.

How to read the symbols

• "<10" — the group has fewer than 10 people or is hidden by complementary suppression.
• "—" — no data.
• "<5 %", ">95 %" and similar bands — the share is known only approximately (see "Shares").