Solutions · Suggestion box
An anonymous suggestion box the platform can't read.
Most digital suggestion boxes store submissions as plain text next to a timestamp and an account. InviziPoll encrypts each submission in the browser before it is uploaded. We store ciphertext only - so there is no readable backlog for anyone to search, subpoena, or leak. A suggestion box only works if people believe that.
No credit card. Box open in < 2 min.
No login for submittersCiphertext-only storageMinimum group thresholds
Example admin dashboard with example data: recommendation results decrypted in the admin's browser above, and the stored responses, which are ciphertext only, below.
sealed before it reaches usEveryone can speak up. No one is singled out.
The short answer
Are submissions really anonymous?
Yes, by design. Answers are encrypted in each person's browser before upload, and our servers never hold a readable one. Admins see totals and charts, and written comments word for word, in a shuffled list with no name, time or order attached. Where the poll allows it, anyone who'd rather not be read can send just the topics they pick instead. For the full model, see Security & encryption.
Evaluating another tool? Not sure if your survey is anonymous? Here's how to tell. For the confidential vs anonymous distinction, see our definition guide.
Encrypted in the browserReadable only in the submitter's browser and your team's browsers, never on our servers.
No identity to attachNo login and no cookies. Rate limiting keeps a one-day keyed hash, not the IP address.
Thresholds before anything showsFree text stays suppressed until the group is large enough.
Feature snapshot
Built for candour, not for a shared inbox.
InviziPoll vs a typical digital suggestion box or shared feedback form.
Aspect
InviziPollTypical suggestion box
Individual answer storage
InviziPollCiphertext only
Ciphertext only - encrypted in the respondent browser before upload.
Typical suggestion boxVaries
Often server-readable plaintext or optional anonymity modes - verify each vendor's architecture.
Admin reporting
InviziPollNo one identifiable
Totals, charts and written comments, decrypted in your browser, in a shuffled list with no name, time or order attached. People can send just topics instead.
Typical suggestion boxPlan-dependent
May include per-response views, export trails, or moderation dashboards depending on plan.
Cryptography
InviziPollPost-quantum hybrid
Post-quantum-capable hybrid designs (X-Wing KEM + ML-DSA-65) documented on /security.
Typical suggestion boxTLS baseline
TLS in transit is standard; end-to-end encryption for survey payloads varies widely.
Respondent telemetry
InviziPollNone on ballots
Zero respondent telemetry on ballot flows - marketing analytics are separate.
Typical suggestion boxOften present
May include session analytics, device fingerprints, or third-party trackers on survey pages.
What teams use it for
Anywhere someone hesitates before hitting send.
Ideas & process improvements
Safety and near-miss reports
Manager and leadership feedback
Anonymous questions for all-hands
Common questions
Common questions
Is an online anonymous suggestion box really anonymous?
It depends entirely on what the tool stores. Most digital suggestion boxes keep submissions as readable text alongside a timestamp, an IP address, or the account that submitted them. InviziPoll encrypts each submission in the browser before upload, so the server holds ciphertext and there is no plaintext record to look up.
How is this different from a shared inbox or a form?
A shared inbox or a standard form gives whoever administers it the ability to read every submission and, usually, to see who sent it. That is confidential, not anonymous. Here the submission is unreadable to the platform, and admins read results and the text of each submission in a shuffled list with no name, time or order attached, rather than an identifiable feed.
Can we still act on individual suggestions?
Yes. Admins decrypt in their own browser and can publish a response without ever learning who submitted. The you-said-we-did flow is designed for exactly this: close the loop publicly so people can see that submitting was worth it.
What stops a small team from being identified?
Minimum group thresholds. Results and free text stay suppressed until enough people have responded, and never fewer than 3. On a small team that threshold matters more than the encryption, because a distinctive story identifies someone even when the record does not.
Do employees need an account to submit?
No. Respondents open a signed link with no login, no cookies and no browser fingerprinting, and we never store their IP address: rate limiting keeps a one-day keyed hash, not the address. Anonymity that requires trusting a login prompt is the thing employees are usually suspicious of.
Open a suggestion box people will actually use.
Workspace in under two minutes. No credit card, no submitter tracking, no plaintext suggestions on our servers.