Aggregate results and anti-inference controls

Encryption stops us reading answers in transit and at rest. Anti-inference is the other half: making sure the people who can read results can't work out who said what from small numbers, timing or filters; this page covers every floor InviziPoll applies, what each one protects, and where the protection stops.

Note

Scores and choices come back as totals. Written answers are shown word for word, shuffled and undated, once results open; nobody sees per-response timestamps or the order answers arrived. Where the poll allows it, anyone who'd rather not be read can send just the topics they pick instead.

#When results open

Nothing is readable below the poll's minimum group size, and that's never fewer than three, open or closed. While the poll is open, the first results appear once the minimum group size plus three have answered, and they show the minimum group size. With the default of 5, that's at 8 answers, showing 5. Until then the page shows the count as "Hidden" and the results tile reads "Locked until" that number. If the poll closes with at least the minimum group size, everything shows at close. A poll that closes below it shows nothing, ever.

#While open, a few answers are held in reserve

After the first results, new answers reach you in randomly chosen groups of three to five, and three are always kept in reserve until the poll closes, so no change you see can be pinned on one person. Without this, an admin could refresh after every answer and read the difference. The line under the count says: "A few answers are always held in reserve until the poll closes, so no one's answer can be picked out." It gives no count. At close, everything left shows. How batched release works.

#What counts are visible before results open

Participation is visible even while answers are locked, so people can check their answer landed and you can chase a low response rate:

The dashboard's Active polls panel shows each open poll's responses against invitations (for example "7 / 40"), a participation percentage and a 14-day trend line.
The respondent's poll page can show a signed response count once it reaches the poll's minimum group size.

What you don't get before results open is any answer, any chart, or anything about who has responded.

#Written answers

Open-text answers are shown to admins word for word once results open. They're displayed in an order derived from the text itself, so the list says nothing about who answered first or last, and they carry no date. Where the poll allows it, anyone who'd rather not be read can send just the topics they pick instead. You can download them for a question as a CSV. Word-cloud answers can also be downloaded raw, shuffled.

Written answers never leave the admin app in anything shared further. The PDF report, the public results page, share-a-slice links and the signed results document show open text only as recurring words with counts.

#Breakdowns only appear at close

If a poll asks self-reported demographic questions, or carries roster attributes from a contact list, you can filter results by them, but only once the poll has closed. Closing it early counts. While it's collecting, the results tab says when breakdowns unlock and why: comparing a group before and after new answers arrive could reveal one person's answers. Polls that never close, the Exit pool and the speak-up channel, never show breakdowns.

At close, two more rules apply:

A floor per group. A filtered group needs at least five answers, or the poll's minimum group size if that's higher. Below that the page says "Insufficient responses for this cohort. No breakdown is shown." with no count.
A check across groups. All the breakdowns are checked together, once, against every release group. A breakdown that could be worked out by subtracting others from the whole is withheld. On the results tab it shows the same locked message as a small group, and a published document simply leaves it out, so a withheld breakdown doesn't tell you which group is small.

The same rules apply to every cut inside a published document and to every share-a-slice link. They can't be lowered.

Example

Eight people answer and the poll closes. One of them is in Legal. Overall results show. Filtering to "Department = Legal" matches one answer, so that view stays locked and shows no count, and a breakdown that amounts to "everyone except Legal" stays locked too, because it would give Legal away by subtraction. Combining filters usually narrows things further.

The poll wizard's Anonymity Coach warns when several demographic questions multiply into many combinations, most of which will stay locked.

#Roster attributes are collapsed before they're sealed

Four authoritative attributes can fingerprint one person even when every single cut clears five. So before a roster is attached to ballots, any value shared by fewer than five people on the roster is dropped, then any combination of values shared by fewer than five is broken up by dropping manager, then tenure band, then location, then department until every combination covers five or more. A dropped value is simply absent. Roster attributes and cuts has the detail.

#Where the floors stop

The floors are real, and they have limits you should know about.

Subtraction beyond one poll. The check at close covers the breakdowns on one poll. It can't see an export someone kept from another poll, or what they already know about a colleague. Keep cuts coarse when a group would be small.
The app enforces the floors, not the encryption. Your browser decrypts each released answer to draw the charts, then applies the floors when it draws them. That's why roster attributes are collapsed before sealing: once an answer is decrypted, the floor is a rule the app follows, not a lock.
Timing. The reserve closes the refresh-and-compare gap, but an answer sent at 2am, or seconds after the invite, is still findable by timing. The employee guide tells people so.
Fake answers. Whoever controls an open link or a batch of access codes could fill a poll with fake answers around one real one. No threshold stops that. Ballots tied to a roster that person doesn't control do.

#The poll's minimum group size

The poll wizard asks for a Minimum group size (k-anonymity), 3 to 100, default 5. It's the number respondents are told must answer before anyone sees anything, the number in the Slack announcement, and when the signed response count appears on the poll page. It also sets when you see results: nothing below it, first results at it plus three while the poll is open, and everything at close. Breakdowns need five or this number, whichever is higher. It's recorded in every published document.

See also Respondent anonymity and zero telemetry. Each page covers the adjacent settings and workflow steps.