Is Candora Anonymous? What HR Sees and What Candora Keeps

What we say about Candora here was checked on 2026-10-28 against its own privacy page, privacy policy (updated 6 October 2026), product page and pricing page. We make a competing product, so weigh our view accordingly. Candora's documentation is unusually plain about how it works, which is why this post can be precise.

01What HR sees

Candora publishes the line itself, and it's a clear one. HR can see:

• the list of people it invited, and whether each one has completed the survey;
• overall participation;
• results for each question, and for each reporting group you set up, once at least three people back them;
• themes drawn from written answers, each backed by at least three people.

HR can't see which person gave which answer, raw answers, any comment word for word, results backed by fewer than three answers, or a breakdown it builds itself. Exports carry no response IDs or timestamps. There's no setting, on any plan, that changes this.

That's a stronger default than most survey tools manage. In Microsoft Forms, Google Forms or SurveyMonkey, the person who owns the form decides whether answers are anonymous, and can change it. Candora takes the decision away from HR entirely.

02What Candora keeps

The boundary is between your employer and Candora, not between you and everyone. To send one-time links, stop duplicate answers and place you in the right group, Candora's privacy policy says it processes your identity alongside your answers, in what it calls a restricted source layer. That layer holds your selections, ratings, written answers, reporting group and submission time. Reports for HR are built from a separate layer that holds only results.

Candora's own FAQ draws the distinction well: a strictly anonymous survey keeps no link between a person and an answer, and a confidential one keeps the link and limits who can see it. On that definition, Candora is confidential with a very firm wall, not strictly anonymous. The wall is enforced by Candora's software and staff, which is better than an HR setting, and different from there being no link to protect.

03Where your comments go

HR never reads your comment, which removes the most common way people get recognised: their writing. To turn comments into themes, Candora's privacy policy says written answers may be processed by AI providers such as Anthropic or OpenAI. The employer gets the theme, after more privacy checks, not your words.

If you're answering, that means your comment is read by software at Candora and, depending on the feature, by an AI provider, but not by your employer. If you'd rather name the issue without writing it in your own words, keep the comment short and general.

04Who answered

HR can see whether you've completed the survey. That's useful for reminders, and it isn't your answer. It does mean that "did you do the survey?" has an answer your employer can look up, which matters on a small team where not taking part is itself a signal.

05Pricing

Candora is $2 per employee a month, billed in US dollars, with a $100 monthly minimum that covers 50 people. A survey of 250 people costs $500 a month; 500 people costs $1,000. Surveys are unlimited, there's no free plan, and self-serve covers up to 2,000 people per survey. Candora is run by Evarin Pty Ltd in New South Wales, and its application and main database are hosted in Australia.

06How to check, if you're answering

• Read the invitation. A private one-time link means Candora knows the invitation is yours.
• Assume completion is visible. HR can see you've finished, so don't rely on silence as cover.
• Keep comments general on a small team. Themes need three people behind them, but a very specific incident can still narrow things down if it becomes a theme.
• Ask your HR team which reporting group you're in. Results for your group are hidden below three answers.

07How to check, if you're running it

Candora gives you a promise you can repeat to staff without hedging: HR can't see who said what, and you can't change that. Be just as plain about the rest: Candora keeps the link, you'll see who has completed, and comments may be summarised by an AI provider. Staff who find that out later will trust the survey less than staff you told up front.

08Where InviziPoll differs

InviziPoll encrypts each answer on the respondent's own device before it's sent, and stores no name, email, IP address or time next to it. There's no restricted layer, because there's no readable copy to restrict. Nobody can see who has or hasn't answered, us included. Written answers are shown to the admin word for word, shuffled and undated, and anyone who'd rather not be read can send only the topics they pick. Summaries are drafted by a model running in the admin's own browser; no answer is ever sent to an AI provider.

Candora does things we don't: it runs the survey for you and writes the leadership report. If that's the job, it's a reasonable choice. If the job is being able to say "nobody can see who said this, including the vendor," see InviziPoll vs Candora and /trust/anonymity.

For the wider picture, see the anonymity fine print of 12 employee survey tools and confidential vs anonymous surveys.

FAQQuestions people ask