Threat model

InviziPoll is designed for respondent anonymity and confidentiality by design: the platform cannot read plaintext answers or access admin key material without secrets that stay on the client or with trusted admins.

What the architecture protects against

Threat	How we address it
Database breach	Encrypted blobs; no service plaintext
Insider access to sensitive data	Ops role cannot read ciphertext/keys
Small-group deanonymization	Locked until 3+; cohorts need 5+
Linking access codes to responses	No reversible link to submissions stored
Ordering inference	Ciphertext returned in random order
Manager sees more than their team	Snapshot links, never the poll key
Answers sent to an AI provider	Summaries run in the admin's browser

What we do not claim to prevent

Limitation	Notes
Compromised admin device	Unlocked admin sees decrypted views
Weak backup passwords	Low-entropy passwords remain guessable
Social engineering	Users may share backup secrets
Server-assisted checks	Eligibility checks; no answer decrypt
Availability	Outages do not imply breach
Self-identifying free text	Content can identify its writer
Small on-device model	May restate one person; read as a draft

Related reading

• Encryption model overview
• Access codes and anonymity
• Anti-inference deep dive
• Share a slice
• On-device AI summaries