Publishing results as a signed document

Publishing writes a signed summary of a poll's results to its public results link. It's a deliberate act: you read the numbers, you choose a date, and the public page shows that summary with an "as of" line until you publish again. Use it when you want people outside the admin app to read the same aggregate you're looking at, and to be able to check that nobody edited it on the way.

The public page shows one document, not a live tally. The server can't compute an aggregate because it can't read a single answer, so the only thing that can publish is a browser holding the poll key. That's yours.

When to use it

A town hall or all-hands where everyone should see the same charts, on a link that doesn't need a login.
A leadership team that should read the result without being given the poll.
A consultant or investigator handing a client a finding the client's own security team can verify.
A recurring pulse where the link should show the final numbers for each wave.

For one team's numbers going to one manager, use Share a slice instead. Publishing is poll-wide.

What gets published

The document is an aggregate, computed in your browser from the responses it has decrypted, then sealed and signed before it leaves. It carries:

Counts and percentages per question, and scale statistics where they apply.
Open-text questions as recurring terms with counts. No written answer is in it.
The three floors that governed it, written as numbers: results open at three responses, a cohort or cut needs five, and the minimum you chose for the poll when you set it up.
The cut catalog, if the poll carried roster attributes or demographic questions. Every cut in it clears the floor of five.
The poll title, the wave number if it's part of a series, and the date the summary is as of.

It does not carry any written answer, any per-response data, any submission time, or anything naming who computed it. A reader with the document and the workspace's public key can check the signature without asking you or us. See Verifying a published results document.

Publishing from the results page

The control sits on the results tab of a published poll, beside Share a slice, once results are open and public results are switched on. It's headed Publish results to your public link, and it says what the click does: publishing writes a signed summary of these results to your public link, and nobody sees the underlying responses.

Open the poll's results tab. Results have to be open, which means at least three responses. Below that there's nothing to publish and the control says so if you try.

Check the signature warning, if there is one. If this browser hasn't unlocked your workspace encryption, the control tells you before you click that the link won't carry a verifiable signature. You can still publish. You can also open your workspace keys first and publish signed.

Enter the results PIN, if the poll has one. Readers need it to open the summary, and so does your browser to seal it. The PIN is never stored.

Click Publish results. The toast says either "Signed results published" or "Results published, unsigned".

After the first publish the control changes to Published results, shows the day you published and the live response count next to it, and the button becomes Republish. That pairing is deliberate: "published 3 September, 47 responses now" lets you see whether republishing would change anything, without the product deciding for you.

Republishing overwrites. There's one current document per poll and no history. Somebody who saved the earlier document still holds a valid signed claim about the date inside it.

When a publish is owed

When a poll closes, or a wave of a series closes, the server marks that a publish is owed and the control says so in plain terms:

Before any publish: "This poll has closed. Publish so the people you asked can see what came back."
After one: "This poll has closed since you last published. Republish so the public link shows the final numbers."

For a wave the sentence starts "This wave has closed" instead. If you've already published once, the poll needs no PIN, and your browser can sign, the republish happens on its own the next time you open the results page. The first publish is never automatic. Automatic publish at close and per wave covers the rules.

What respondents see

The public page has a small number of states, and it moves through them in this order.

Below the floor. With fewer than three responses the page says "Results not yet available" and that results become available after at least three responses. This check runs before anything else, so a summary published earlier can't keep showing if the poll somehow drops under the floor.
Not published yet. Public results are on and nothing has been published. The page says "This workspace hasn't published results for this poll yet. When they do, you'll see a signed summary here." It says nothing about whether anyone has answered, because that isn't this page's to tell. If you've published a You said, we did plan, it shows here already.
Results PIN. On a PIN-gated poll the page asks for the PIN before it opens anything. Entering it decrypts the summary in the reader's browser. A wrong PIN says "Invalid PIN, or these results couldn't be opened."
Published. The poll title, then "As of ", the wave number if there is one, and the response count. Under that, the signature sentence: "Signature checks out. These numbers are exactly what the workspace published." Then the charts.
Published, not verified. The same page with a warning in place of the check: "We couldn't verify this." followed by the reason. Most often it's that the document carries no signature, because the browser that published it hadn't unlocked the workspace encryption. The numbers still render. The page never quietly shows an unchecked document as if it were checked.

The "as of" date comes from inside the signed document, not from a server clock. That's why there's only one date on the page.

Turning public results off

Switching public results off on the poll page withdraws the document as well as the link. All of it is cleared, so the toggle can't put a stale claim back on the web later. Switching public results back on gives you an empty public page until you publish again.

Limits and gates

Publishing is available to the poll's owner, on any workspace that can switch public results on. There's no separate plan gate on the control.
Results must be open: at least three responses. Cuts inside the document need five each, and cuts below that are left out rather than marked.
A document has a size ceiling. If a poll is too large to publish, the control says so and asks you to shorten the poll. A large cut catalog is trimmed to a fixed cap rather than failing the publish.
Signing needs a browser with your workspace encryption open, and a workspace signing key. Only an owner or admin can set that key up, and it's created the first time one of them publishes or shares a signed slice.
A poll that requires a PIN never republishes on its own, because the PIN isn't kept anywhere.