Slack distribution and respondent anonymity

InviziPoll's Slack integration puts a poll in front of people and never collects answers inside Slack. Each way of sending through Slack behaves like its email or link equivalent, and this page explains what that means for each mode.

#How Slack distribution preserves anonymity

There are three ways to send a poll through Slack:

• A channel post with the poll's open link
• A direct message with a personal access code
• A direct message with a personal invite link

#Channel posts

A channel post carries the poll's public link and a button to open it. There's no per-person code, so there's nothing to correlate with answers, and we can't tell who in the channel answered. Anyone with the link can respond, subject to the poll's other access settings. Like any open link, it doesn't stop one person answering twice.

#Access codes by DM

Each recipient gets a unique code in a direct message. We store only a one-way hash of each code, not the code, and we don't keep which Slack user got which code after the messages are sent. When someone submits, the hashed code is checked and marked used in the same step that stores their answer. The stored answer is the poll and its ciphertext; it doesn't carry the code, the hash, or anything about the Slack user.

So after an access-code DM send, we can't determine:

• Which Slack user submitted which answer
• Whether a specific Slack user has responded
• Any link between a Slack user's identity and their answers

We can see how many codes have been used, which is how the response count works.

#Personal invite links by DM

Each recipient gets a one-use personal link in a direct message. When they open it, their browser swaps it for a blind-signed anonymous ballot, so we can't match the answer that comes back to the link. See Access codes and anonymity.

This mode is different in one respect. To issue one ballot per person, we keep each invited address as a one-way hash, and record whether that invite's ballot has been issued and on which day. So for a personal-link send we can tell that an invited person has opened their link and taken a ballot. We still can't tell which answer is theirs.

#Why reminders go to everyone

Slack DM reminders are available for access-code polls. Because we don't keep which Slack user got which code, we can't tell who hasn't answered, so a reminder goes to everyone you name, and it asks them to use the code from the original message. Channel reminders post a fresh message in the channel.

This is intentional: a system that could remind only non-responders would be tracking per-person completion, which would weaken the anonymity model.

#No response collection through Slack

InviziPoll doesn't use Slack to collect answers. There are no Slack buttons, forms or message actions that submit answer data. People always answer on the InviziPoll poll page, where answers are encrypted in their browser before they're sent.

#Audit trail

Slack integration events are recorded in the workspace audit log with metadata only (for example, that Slack was connected or disconnected, that a channel post or batch send completed, and counts). They don't include who received a DM or anything about answers.

#Related

• Threat model
• Encryption model overview
• Access codes and anonymity
• Slack integration