Solutions · Exit feedback
Anonymous exit interviews that get an honest answer.
People on their way out have the least reason to be candid and the most worth saying. An exit form HR can read back to a name gets the diplomatic version. We store ciphertext only - answers are encrypted in the browser, pooled across leavers, and released only above a minimum group size.
Ciphertext-only storagePooled across leaversMinimum group thresholds
Illustrative admin dashboard: aggregate recommendation percentages above, individual response rows shown as ciphertext only below.
ciphertext only · no names, no IPsEveryone talks. No one is singled out.
The short answer
Can it be anonymous if HR knows who left?
Yes, by design. Poll responses are encrypted client-side; our servers persist ciphertext, not plaintext answers. Workspace admins decrypt aggregate analytics in authorized clients. For the full encryption model, see Security & encryption.
Evaluating another tool? Not sure if your survey is anonymous? Here's how to tell. For the confidential vs anonymous distinction, see our definition guide.
The answer carries no identityEncrypted in the browser; nothing links it back to a leaver.
Pooled, not per-personResults read as a cohort trend, not a file on one departure.
Held until the group is big enoughA single exit in a quiet month does not become a readable record.
Feature snapshot
Built for the answer people withhold, not for an HR form.
InviziPoll vs a typical exit interview form or HRIS offboarding questionnaire.
Aspect
InviziPollTypical exit form
Individual answer storage
InviziPollCiphertext only
Ciphertext only - encrypted in the respondent browser before upload.
Typical exit formVaries
Often server-readable plaintext or optional anonymity modes - verify each vendor's architecture.
Admin reporting
InviziPollAggregate only
Aggregate analytics in authorized clients; no per-response timelines on admin surfaces.
Typical exit formPlan-dependent
May include per-response views, export trails, or moderation dashboards depending on plan.
Cryptography
InviziPollPost-quantum hybrid
Post-quantum-capable hybrid designs (X-Wing KEM + ML-DSA-65) documented on /security.
Typical exit formTLS baseline
TLS in transit is standard; end-to-end encryption for survey payloads varies widely.
Respondent telemetry
InviziPollNone on ballots
Zero respondent telemetry on ballot flows - marketing analytics are separate.
Typical exit formOften present
May include session analytics, device fingerprints, or third-party trackers on survey pages.
What teams run on it
For the feedback that only arrives when it can't be traced.
Regretted-attrition deep dives
Post-reorg and layoff pulses
Manager-effectiveness signals
Stay interviews
Common questions
Common questions
Should an exit interview be anonymous or confidential?
Most exit interviews are confidential at best: HR knows exactly who is leaving, so the response is attributable by definition. That is the honest framing to give departing employees. An anonymous exit survey is a different instrument - it trades the follow-up conversation for candour, and it is the one that surfaces the reasons people otherwise keep to themselves.
Can an exit survey really be anonymous if HR knows who left?
Only if the response itself carries no identity and the results are pooled. InviziPoll encrypts each answer in the browser and stores ciphertext, and suppresses results until a minimum group size is met, so a single departure in a given month does not become a readable, attributable record.
What should an anonymous exit interview ask?
Keep it short and answerable: the primary reason for leaving, whether anything could have changed the decision, how the person would describe their manager relationship, and whether they would recommend the company. Long exit forms get abandoned by people who have already mentally left.
How do we avoid identifying someone in a small team?
Minimum group thresholds, with a hard floor of three, and restraint on demographic questions. In a small team, tenure plus department plus a free-text comment identifies someone even when nothing in the record names them.
Does this replace the exit conversation?
No, it complements it. The face-to-face conversation handles logistics, goodwill, and anything the person wants attributed. The anonymous survey handles what they will only say when it cannot be traced. Run both and expect them to disagree.
Find out why people actually leave, not why they say they do.
Workspace in under two minutes. No credit card, no respondent tracking, no plaintext answers on our servers.