Confidentiality that's built in, not bolted on

Privacy & confidentiality

1. 01

   Confidential mode

   Responses through personal links can be filtered and compared by grouping fields, because each one carries a snapshot of the person's fields at the time they answered. The link to the person stays internal and is never shown.

   • Any group with fewer responses than the minimum (3 by default, adjustable from 2 to 50) is hidden — including the overall result and trend weeks
   • The list of individual responses stays locked until there are enough of them
   • Nobody can see which answers belong to which person
2. 02

   Anonymous mode

   Nothing links a response to a person — not even in our database. No grouping-field snapshot is kept, and response times are stored to the day only, so a timestamp can't line a person up with an answer.

   • Each personal link still works once, and participation is still counted
   • Results show the overall picture, pillars and drivers — no breakdowns
3. 03

   Fixed once published

   The privacy mode is chosen while the survey is a draft and locked when it's published, so the promise people answered under stays true.

4. 04

   Respondents see the promise

   The survey page tells respondents up front which promise applies — confidential or anonymous — in their own language.

5. 05

   Survey keys stay out of URLs and logs

   The key in a survey link travels after the # and reaches us in a request header, never in an address. Our logs redact survey links, because a key and a time side by side could undo a promise.

6. 06

   The language someone answers in is never recorded

   Respondents can switch language freely, and their choice is never sent or stored. In a small team, a rarely used language could single someone out.