Replying to an anonymous report

An anonymous channel that only collects is half a channel. Someone reports a problem, and then silence: they can't be told it was read, can't be asked the one clarifying question that would make it actionable, and can't be given an outcome; this page explains how InviziPoll closes that loop without ever learning who wrote the report.

#What the reporter does

On a poll with replies turned on, the response page offers a checkbox before submit: Get a return code so we can reply. It's ticked by default, and unticking it submits exactly as before, with no way to write back.

1. The browser draws a code. Twenty-six characters in five groups, from a random draw that happens on the reporter's device. The last character is a checksum, so a mistyped code fails locally instead of looking like silence.
2. The code becomes a keypair. It's expanded with HKDF-SHA-256 into the seed for an X-Wing keypair. Nothing is stored: the same code re-derives the same keys on any device, months later.
3. The identifier travels inside the ciphertext. A short block naming the mailbox and its public key is sealed together with the answers, so it reaches us only as part of the encrypted response.
4. The code is shown once. On the confirmation screen, with copy, download and print. There's no second chance, and the screen says so.

Later, the reporter opens the reply page, types the code, and sees the status of their report plus anything you've written back. Once someone on your side has opened the report, they can send a follow-up from there too.

#When a report reaches you

On the always-on speak-up channel, reports are released one at a time once the first ones are in:

• A lone first report can't be read until the first release. Nothing is readable until the channel's minimum group size has reported. The speak-up preset sets it to three, the lowest it goes. If one person reports and nobody else does, you won't see it, and you can't acknowledge it.
• After that, each new report reaches you on its own as soon as it arrives. The respond page tells reporters this before they submit.

If you need the seven-day acknowledgement clock of the EU Directive below, keep the channel's minimum group size at 3. Say in your policy that the very first reports wait, and keep another route open for anything urgent.

Any other poll with replies on releases like every poll: first results at its minimum group size plus three, then random groups of three to five, with a few always held in reserve until it closes. Switching replies on gives people return codes; it doesn't make a poll release one report at a time. How batched release works.

#What the admin sees

Once a report is released, two surfaces show it:

• On a written answer. Any answer whose reporter took a code gets a Reply control and a status selector. Answers from people who declined a code show nothing at all, which is also how you can tell the two apart.
• The Speak-up inbox. One row per report that carries a code, on Business and Enterprise plans, and on workspaces trying the Business features preview during a trial. Each row shows the status, how many weeks old the report is, the conversation so far, and a composer. A chip at the top counts reports still awaiting acknowledgement and names the oldest week. See The Speak-up inbox and case status.

Status is one of four coarse values: received, acknowledged, under review, closed. Sending a reply marks a report acknowledged on its own, so there's no state where you've answered someone but the record says you haven't.

If a poll asks more than one written question, a single person's answers appear in more than one list and share one conversation. A reply sent from any of them arrives in the same place.

#What we hold and what we don't

This is the part worth reading before you write a policy around it.

Two consequences follow, and both are load-bearing.

We can't recover a lost code. Not for the reporter, not for you, not for a regulator. The code is the key, and we never see it.

We hold no submission time for a report. Response records deliberately carry no timestamp. The age you see in the inbox comes from a week the reporter's own browser recorded and sealed inside their response, which is why the inbox says "3 weeks ago" and never a date. A reporter could set it wrong, and only weakens their own position by doing so.

Replies you write are encrypted to the reporter's key, not to the poll key. Once sent, nobody else can read them back, including you. A public results link shows only a summary document you publish by hand. It can't open individual responses, follow-ups or replies.

#EU Whistleblowing Directive 2019/1937

Organisations in the EU above a size threshold must run an internal reporting channel that acknowledges receipt within seven days and gives the reporter feedback within a reasonable period not exceeding three months. The obligations are in Article 9 of Directive (EU) 2019/1937.

What the product does, stated as plainly as we can:

Four gaps you have to close yourself. Only the first reports wait: nothing on a speak-up channel is readable until its minimum group size has reported, so keep that at 3 if you need the seven-day clock. Acknowledgement only reaches a reporter who kept their code and comes back to check. The seven-day and three-month clocks are yours to run, because we hold no submission time to run them from. And handling records beyond a coarse status, such as who investigated and what was decided, live in whatever case system you already use.

#Known limits

The reporter has to check in. There's no notification, and there can't be one: a notification needs an address, and collecting an address would undo the anonymity the channel exists for. Tell people this when you publish the channel, and give them a reason to come back, for example "we answer within a week, so check on Monday".

Follow-ups aren't authenticated. A mailbox identifier is unguessable, but it isn't a password, and it sits inside the response ciphertext. Anyone who can decrypt that poll's responses, which means people in your workspace with access to its results, can read it and could post a follow-up into a conversation you've opened.

What that does and doesn't mean:

• They can't read your replies, which are encrypted to the reporter's key alone.
• They can read the reporter's follow-ups, which are encrypted to the poll key like any response.
• They can add a message that will appear to come from the reporter.

So treat a follow-up as text, not as proof of who sent it, and keep access to a speak-up poll's results to the people who handle reports.

No case management. No assignment, no due dates, no evidence uploads, no export for counsel. A conversation caps at forty messages, and each message caps at 4,000 characters.

Replies end when responses do. A conversation is deleted with the poll's responses under the same retention setting. If a three-month feedback obligation applies, set retention long enough to cover it.

#Turning it on

Replies need an active paid plan or trial. The wizard shows Let people ask for a return code so you can reply on the Distribution step for any poll with a written question, and the always-on speak-up template turns it on for you. On a live poll, the Anonymous replies switch sits at the top of the Speak-up inbox once results are open, on plans that include the inbox.

Turning replies on affects responses submitted from that point onward. Answers already collected have no return code and can't be given one, because the code never existed anywhere we could reach.

#Related

• QR posters and pulse presets