A Survey That Tells You How It Protects You

01The promise nobody can check

Think about the line at the bottom of a survey invite. "Your responses are completely anonymous." Who wrote it? Usually someone in HR who believes it. Who reads it? Someone who's seen a colleague get "a quick chat" a week after a survey closed, or who noticed the survey asked for their team, their office and how long they've been there.

The person answering has no way to tell whether the promise is true for this survey. So they hedge. They pick the middle of the scale, skip the comment box, and the results come back politely useless.

We've written before about how to explain anonymity honestly in an invite. This goes one step further: put the explanation on the ballot, and let the poll explain itself.

02What the ballot shows

Before the first question, the person answering sees a short list. Each item has a label as well as a colour: Protected, Worth knowing or Watch out. It covers:

• When anyone first sees results, and that answers come through in groups, never one at a time.
• How they got the poll, in words that fit: the same link as everyone, a code that can't be tied to their answer, or a personal link that can't be matched to what they say.
• Reminders, and the honest detail that on personal links we know whether someone opened theirs, never whether or what they answered.
• Whether any question asks who they are.
• How many details put them in a group, like team, location or tenure.
• Details taken from the company's records rather than asked, with their own values shown to them, and only to them.
• Whether written answers are read as written, or whether they can send topics instead of their words.
• Whether results come back to them.
• Whether there's a live count anyone could watch.

Nothing on the list stops anyone answering. It informs. They decide.

03Why we show the yellow and red items too

It would be easy to show only the green ones. It would also be the same empty promise with nicer formatting.

If a poll asks for an employee ID, the ballot says so, under Watch out, and tells people they can skip it. If comments are read as written, it says leadership reads them as written and suggests leaving out names and places. If a live count is on, it says anyone with the link can watch it go up.

That's uncomfortable for the person who built the poll. It's meant to be. Which brings us to the other half.

04The admin sees it first

On the poll builder's Review step, admins see What your respondents will see: the exact same list. Every Worth knowing or Watch out item links to the step that changes it. Nothing blocks publishing, but it's hard to send a poll with a red line on it once you've seen how it reads to the people answering.

We changed two defaults to match. New polls share results back with the people who answered, so a See the results link appears on the thank-you page and the closed poll. Nothing goes public until the owner publishes, and what's published is grouped totals. And new polls don't show a live response count, because a counter that ticks up can hint at when someone answered.

05Why the details from company records matter

Some polls attach details like department or location from the company's records instead of asking. That's how results get split by team without asking anyone to fill in their team. But until now, the person answering couldn't see what was attached.

Now they can. The ballot shows "From your company's records: Department: Engineering, Location: Leeds", to them and nobody else. Those details only count for groups of at least five people. If you're going to attach something to someone's answer, they should get to see it.

06What this buys you

Honest answers come from people who believe the survey, and people believe what they can check. A ballot that shows its working, including the parts that aren't perfect, gives them something to check. The encryption underneath is the proof that it holds up. The checklist is how they find out without needing to understand it.

FAQQuestions people ask