Publishing results as a signed document

Publishing writes a signed summary of a poll's results to its public results link. It's a deliberate act: you read the numbers, you choose a date, and the public page shows that summary with an "as of" line until you publish again; use it when you want people outside the admin app to read the same aggregate you're looking at, and to be able to check that nobody edited it on the way.

Good to know

The public page shows one document, not a live tally. We don't hold a readable copy of any answer, so our server has nothing to compute an aggregate from; the only thing that can publish is a browser holding the poll key; that's yours.

#When to use it

A town hall or all-hands where everyone should see the same charts, on a link that doesn't need a login.
A leadership team that should read the result without being given the poll.
A consultant or investigator handing a client a finding the client's own security team can verify.
A recurring pulse where the link should show the final numbers for each wave.

An employer rating is published the same way, with extra rules: it's always signed, never behind a PIN, and it feeds your public rating page and badge.

For one team's numbers going to one manager, use Share a slice instead. Publishing is poll-wide.

#What gets published

The document is an aggregate, computed in your browser from the responses it has decrypted, then sealed and signed before it leaves. It carries:

Counts and percentages per question, and scale statistics where they apply.
Open-text questions as recurring terms with counts. No written answer is in it.
The anonymity floors, written as numbers: the platform's lowest results floor of three, the poll's cut floor (five, or its minimum group size if higher), and the minimum group size you chose, which is the smallest group the poll ever shows.
The cut catalog, if the poll carried roster attributes or demographic questions and has closed. Every cut in it clears the poll's cut floor and was checked against the release batches; some are left out, with no reason given. A document published while the poll's open carries no cuts, and an always-on poll (an exit pool or a speak-up channel) never carries any.
The poll title, the wave number if it's part of a series, and the date the summary is as of.

The response count in the document is the answers released when you published. While the poll's open, a few are always held in reserve and the rest arrive in random groups of three to five, so a document published mid-run leaves the reserve out. At close, everything shows, so a document published after close covers every answer. How batched release works.

It does not carry any written answer, any per-response data, any submission time, or anything naming who computed it. A reader with the document and the workspace's public key can check the signature without asking you or us. See Verifying a published results document.

#Publishing from the results page

The control sits on the results tab of a published poll, once results are open and public results are switched on. It's headed Publish results to your public link, and it says what the click does: publishing writes a signed summary of these results to your public link, and nobody sees the underlying responses.

Open the poll's results tab. Results have to be open. While the poll's collecting, that's three answers past its minimum group size; once it closes, it's the minimum group size itself (never below three). Before that there's nothing to publish and the control says so if you try.

Check the signature warning, if there is one. If this browser hasn't unlocked your workspace encryption, the control tells you before you click that the link won't carry a verifiable signature. You can still publish. You can also open your workspace keys first and publish signed.

Enter the results PIN, if the poll has one. Readers need it to open the summary, and so does your browser to seal it. The PIN is never stored.

Click Publish results. The toast says either "Signed results published" or "Results published, unsigned".

After the first publish the control changes to Published results, shows the day you published and how many answers are released now next to it, and the button becomes Republish. That pairing is deliberate: "published 3 September, 47 responses now" lets you see whether republishing would change anything, without the product deciding for you.

Republishing overwrites. There's one current document per poll and no history. Somebody who saved the earlier document still holds a valid signed claim about the date inside it.

#When a publish is owed

When a poll closes, or a wave of a series closes, the server marks that a publish is owed and the control says so in plain terms:

Before any publish: "This poll has closed. Publish so the people you asked can see what came back."
After one: "This poll has closed since you last published. Republish so the public link shows the final numbers."

For a wave the sentence starts "This wave has closed" instead. If you've already published once, the poll needs no PIN, and your browser can sign, the republish happens on its own the next time you open the results page. It covers every answer, because everything shows at close, and it's the first document that can carry cuts. The first publish is never automatic. Automatic publish at close and per wave covers the rules.

#What respondents see

New polls share results back by default, so the people who answered get a link to this page on the poll page, the thank-you page and the closed page. Until you publish, that link says "Results appear here once leadership publishes them." See Public results link for the defaults.

The public page has a small number of states.

Not published yet. Public results are on and nothing has been published. The page says "This workspace hasn't published results for this poll yet. When they do, you'll see a signed summary here." It says nothing about whether anyone has answered, or how many, because that isn't this page's to tell. The server doesn't even count responses for this page until there's a document to serve.
Below the floor. Once there's a document, the floor is checked before it's served. With fewer than three responses the page says "Results not yet available", so a summary can't keep showing if the poll somehow drops under the floor. If you've published a You said, we did plan, it shows here already.
Results PIN. On a PIN-gated poll the page asks for the PIN before it opens anything. Entering it decrypts the summary in the reader's browser. A wrong PIN says "Invalid PIN, or these results couldn't be opened."
Published. The poll title, then "As of <date>", the wave number if there is one, and the response count. Under that, the signature sentence: "Signature checks out. These numbers are exactly what the workspace published." Then the charts.
Published, not verified. The same page with a warning in place of the check: "We couldn't verify this." followed by the reason. Most often it's that the document carries no signature, because the browser that published it hadn't unlocked the workspace encryption. The numbers still render. The page never quietly shows an unchecked document as if it were checked.

The "as of" date comes from inside the signed document, not from a server clock. That's why there's only one date on the page.

#Turning public results off

Switching public results off on the poll page withdraws the document as well as the link. All of it is cleared, so the toggle can't put a stale claim back on the web later. Switching public results back on gives you an empty public page until you publish again.

#Limits and gates

Publishing is available to the poll's owner, on any workspace that can switch public results on. There's no separate plan gate on the control.
Results must be open (see step 1). Cuts only go into a document published after close. Each needs five, or the poll's minimum group size if higher, and a cut that doesn't clear the floor or the batch check is left out rather than marked.
A document has a size ceiling. If a poll is too large to publish, the control says so and asks you to shorten the poll. A large cut catalog is trimmed to a fixed cap rather than failing the publish.
Signing needs a browser with your workspace encryption open, and a workspace signing key. Only an owner or admin can set that key up, and it's created the first time one of them publishes or shares a signed slice.
A poll that requires a PIN never republishes on its own, because the PIN isn't kept anywhere.

See also Viewing results. Each page covers the adjacent settings and workflow steps.