We Read the Anonymity Fine Print of 12 Employee Survey Tools

That isn't a scandal. Most of these vendors say so plainly in their help centers. The problem is that the word employees hear in the all-hands is "anonymous," and the fine print says something narrower.

01How we did this

Each tool below has its own teardown on this blog, written from that vendor's public help center, support and product documentation. Every claim on this page comes from one of those teardowns, and each row links to the full article with its sources. The "Last checked" column is the date we last verified that article against the vendor's own documentation. Vendors change settings and defaults, so treat a date more than a few months old as a reason to check again.

We didn't test private admin consoles or contract terms, so this describes how each product is documented to work, not how any one company has set it up.

A disclosure: InviziPoll makes an anonymous polling tool, so we're not a neutral party. That's why every row points back to the vendor's own words rather than ours.

02The 12 tools at a glance

General form tools

These are tools people reach for when HR doesn't have an engagement platform, or when a manager wants a quick pulse.

HR engagement platforms

These are the tools behind most annual engagement surveys and weekly pulses.

03What we found

1. The form tools have no floor at all

None of Microsoft Forms, Google Forms or SurveyMonkey hides a group because it's small. If two people answer, the owner sees two answers. Qualtrics only adds a floor on its Employee Experience dashboards, while its CoreXM export shows responses row by row.

That matters more than the name setting. On Microsoft Forms, even with names off, the export still carries the exact second each person started and submitted. If the owner pings a five-person channel and watches replies come in, the timestamp does the identifying.

2. "Confidential" is the industry default, and the vendors say so

Culture Amp, Gallup, Viva Glint, Workday Peakon, Officevibe, Quantum Workplace and Leapsome all keep your answers linked to you behind the scenes. That link is how they break results down by manager, department, location and tenure. Microsoft's own Viva Glint documentation tells HR admins to describe surveys as confidential for exactly that reason, and Quantum Workplace states that it can trace responses back to the participant.

What protects you in a confidential survey is a promise and a threshold, not the absence of a link.

3. Thresholds are smaller than people assume, and some can move

The minimum group sizes we found run from 3 to 5 for scores, and several are the employer's choice. Workday documents 3 as the lowest option an organization can choose for Peakon, and Quantum Workplace leaves the number to the admin while recommending 5. Lattice lets admins lower its threshold while a survey runs or after it closes, so the number at launch isn't necessarily the number when results are read.

Comments get a higher bar on some platforms (10 on Gallup and, by default, Viva Glint), but on Culture Amp, Peakon and Glint the text itself is shown word for word. A distinctive phrase can identify someone in a way a score never will.

4. Exit and onboarding surveys play by different rules

Culture Amp's onboarding and exit surveys are identifiable by default, and Lattice lists both as always identifiable. If you were blunt in an engagement survey because it was confidential, don't assume the exit survey from the same vendor works the same way.

5. Settings decide more than products do

Microsoft Forms, Google Forms, SurveyMonkey, Qualtrics, Lattice, Leapsome and Officevibe all let whoever runs the survey change how identifiable it is. Usually there's a sign: a greeting line above Question 1 on Microsoft Forms, the top of a Google Form, a privacy badge on Officevibe, or the kind of link you were sent on Qualtrics and SurveyMonkey. Each teardown shows where to look.

6. A threshold on the dashboard isn't a threshold on the data

Workday offers Peakon customers, on request, a Survey Answer Export that pulls survey scores and responses "along with identifying email or employee IDs" into the company's own analytics tools. Lattice admins can export individual responses that keep manager and department. In both cases the minimum group size protects what managers see on a dashboard, not what an analyst can download.

04If you're running the survey

• Say "confidential" if that's what your tool does. Employees forgive a narrower promise. They don't forgive finding out that "anonymous" meant something else.
• Check the floor before you send, and don't lower it after launch.
• Know where comments end up. Verbatim text is the most identifying thing in most surveys.
• Treat exit and onboarding surveys separately. On several platforms they're identifiable by design.

05If you're answering one

• Look for the line at the top of the form, the privacy badge or the way your link reached you. Most tools tell you something before you submit.
• Ask HR what the minimum group size is, and whether it can change.
• Keep open-text answers about what happened, not who you are. Our guide on how to stay anonymous in a workplace survey goes further.

06Where InviziPoll fits

We built InviziPoll for the cases where "confidential" isn't enough: answers are encrypted in the respondent's browser, so neither we nor the employer can read an individual reply, and nothing is shown until a minimum group has answered. If you want the long version of how vendors differ on what they can technically read, see employee engagement survey tools compared, or read our guarantees on /trust/anonymity.

07Using this page

Journalists and bloggers are welcome to cite or reproduce the tables with a link back to this page. Each tool's row links to the full article and its vendor sources, which is where any quote should come from.

FAQQuestions people ask