Is Your Client Survey Anonymous to You? Seven Questions for Your Vendor

When you run a survey for a client, you're the one who tells their staff it's anonymous. Usually that means the client won't see names. It rarely means nobody can. The survey tool still knows who said what, the vendor can read it, and so can whoever holds your login. You're promising that nobody will look.

Employees can tell the difference, even if they can't name it. So they answer carefully, the comments come back polite, and the report says what everyone already thought.

The fix starts with a better question than "is it anonymous?" Ask: anonymous to whom?

Three parties, not one

A client survey has at least three parties who could, in principle, connect an answer to a person:

• The client. This is the one everybody thinks about, and most tools handle it with reporting rules: hide names, hide small groups.
• The vendor. The company whose servers hold the answers. If it can read them, so can anyone who compels it, breaches it, or works there.
• You. The consultant with the login. If your account can see who answered what, your firm is holding identifiable feedback about somebody else's employees.

Most "anonymous" surveys protect against the first party with a policy and leave the other two alone. The industry word for that is confidential: someone can see who said what, and promises not to look. It's a fine arrangement for a lot of questions. It isn't fine for a harassment climate read, a layoff aftermath pulse, or an upward review of a CEO who's still in the job, which is a lot of the work consultants get hired for.

Seven questions to ask before you promise anything

Put these to any vendor, including us. The useful thing about them is that a weak answer sounds weak out loud.

1. What's stored next to each answer?

A name and email are the obvious ones. Also ask about IP addresses, timestamps, device details, and the personal link someone answered through. A timestamp alone can identify the one person who answered at 11pm on a Sunday.

A good answer: nothing that identifies the person is stored with the answer. A weak one: "we don't show it in the reports."

2. Is "anonymous" a setting?

If anonymity is a toggle, someone can leave it off, switch it off, or switch it on after the first few people have answered. Ask who can change it, and whether it can change once a survey is live.

A good answer: there's no setting, because there's no identity to reveal. A weak one: "admins set it per survey."

3. Can you, the vendor, read individual responses?

Ask it plainly, then ask the follow-up: if a court, a regulator or an attacker asked you for them, what could you hand over?

A good answer: only data we can't read. A weak one: "our staff are bound by strict policies."

4. What's the smallest group a result will show for, and can it be worked out by subtraction?

A floor of five is common. The gap is that a floor protects each group on its own, not the difference between two of them. If "Engineering" shows 20 people and "Engineering excluding the platform team" shows 15, you've just shown the platform team's five, and if one of those groups is smaller still you've shown a person.

A good answer: the floor is fixed when the survey launches, and any group that could be worked out from the others is left out. A weak one: "we show a warning on small groups."

5. Is there an export with identifiers in it?

Plenty of tools offer a raw data extract that can include an email or employee ID next to each response, usually for good reasons. Find out whether one exists, who can switch it on, and whether employees are told.

6. If I work across several clients, what does my login actually hold?

One account for every client makes your firm the custodian of all of them. An account per client, paid for by the client, gets awkward the day the engagement ends. Ask whether each client gets its own space, owned by the client, with its own key, and what happens to the data when you leave.

7. Can the client's staff check any of this without taking your word for it?

This is the one that matters to the people answering. Is there a plain-language page they can read? Can results be published in a form the client's own security team can verify hasn't been edited?

How we answer them

I built InviziPoll because I couldn't give good answers to these with the tools consultants were using. So, briefly:

1. An answer is stored with no name, email address, IP address or time beside it, and the personal link someone answered through isn't kept with what they said.
2. There's one mode. Nothing to switch on, nothing to forget.
3. Answers are encrypted in each person's browser before they're sent. We store ciphertext and can't read it, so ciphertext is all we could ever hand over.
4. Nothing shows until a poll's minimum group size has answered. Breakdowns appear once the poll closes, for groups of five or more, and one that could be worked out by subtraction is left out.
5. There's no export with a name in it, because there's no name to put in one.
6. Each client gets its own workspace, owned by the client from day one, with its own key. You work across all of them from one login.
7. How this protects you is written for the employees, and results can be published as a signed document anyone can check.

One thing to be straight about: you still read the results, comments included. You need to, to write the report. What you can't do, and the client can't do, and we can't do, is find out who wrote any of it.

What to tell the client's staff

Once the answers to those seven questions are good, say so in the kickoff email in plain words. Something like:

It's a short sentence, and it's only worth anything if it's true.

Add one line of advice to it. No system can stop a comment identifying its writer by what it says, so ask people to leave out names and details only they would know. That's not a weakness in the tool. It's the one part of anonymity that's in the writer's hands.

FAQ