Shadow IT, plaintext at rest
Spun up without a security review
Plaintext or policy-gated confidential data
In scope when counsel subpoenas the vendor
Producible · readable report bodies
Encrypted speak-up channel for employee feedback
Security and compliance teams often inherit sensitive employee feedback running on general-purpose forms: shadow IT with a large legal discovery surface. InviziPoll supports speak-up programs with browser-side encryption and ciphertext-only storage, so there are no readable response bodies for us to produce under subpoena.
Browser-side encryptionCiphertext-only storageTwo-way anonymous repliesSIEM audit metadata
Shrink the discovery surface
A vendor can only hand over what it holds
HR and ethics programs frequently spin up Google Forms, Microsoft Forms, or legacy survey tools without a security review. That expands what opposing counsel can request from a vendor during litigation or regulatory inquiry.
Ciphertext only, customer-held keys
Response table holds ciphertext only
Customer-held keys decrypt in admins' browsers
No name, time or order attached to a report
Producible · encrypted blobs, no keys
Built for security review
Audit the admins, never the answers
SIEM metadata, not answers
Stream tenant-scoped audit events to Splunk, Datadog, or your SIEM: admin actions and configuration changes, never respondent answers.
streams: logins · poll lifecycle · access
Enterprise identity
Pair with SAML/OIDC SSO and optional SCIM directory sync so IT can provision and deprovision workspace access without manual account hygiene.
provision: SSO · SCIM 2.0 · verified domains
Verifiable, not promised
We can't reconstruct a readable answer on our servers, and security reviewers can verify that on /security and in our encryption docs.
envelopes: ML-KEM-768 · ML-DSA-65
Always-on, both ways
Reply to a reporter without learning who they are
Run a standing encrypted channel, not a separate hotline SKU. Pin an open link or Slack announcement for continuous intake with k-anonymity thresholds.
Case status you set
- received
- acknowledged
- under review
- closed
- 01reporter
Takes a return code
Created in their browser before submitting. It never reaches us.
- 02reporter
Submits a sealed report
Encrypted in the browser, stored as ciphertext with no name, time or order.
- 03your team
Acknowledges and replies
Set a case status and write back without learning who they are.
- 04reporter
Checks back with the code
They read your reply on our reply page and can send a follow-up.
The honest caveats
Where the channel ends and your process begins
Built for your program, not instead of your counsel
InviziPoll is the anonymous, two-way intake channel: sealed reports, a return code, case status and replies. Your policy, triage and investigation process stay with your team and your counsel, who should judge fit for your jurisdiction.
Your side · triage · assignment · evidence · legal advice
Nothing notifies the reporter
We hold no address for them, so they check back with their return code. Whether that satisfies a specific obligation, such as the feedback periods in Directive (EU) 2019/1937, is a question for your counsel.
By design · lost codes cannot be recovered
Verify the boundary
Hand your reviewers the architecture
Security hub
Threat model, key custody, and how operator access is separated from poll payloads.
Read moreEncryption docs
ML-KEM-768 envelopes, ML-DSA-65 signatures, and client-side decryption in admin clients.
Read moreAnonymity guarantees
k-anonymity floors, what operators can see, and the honest caveats.
Read moreEnterprise & procurement
SSO, SCIM, and security review for Business plans.
Read moreRelated reads: Anonymous suggestion box design · Confidential vs anonymous · Confidential employee survey
Common questions
How is speak-up feedback encrypted?
Each response is encrypted in the respondent's browser before upload, and InviziPoll servers store ciphertext only. Authorized admins decrypt results, and the text of each report, in their own browsers, with no name, time or order attached. Our servers never hold a readable answer.
What can InviziPoll produce if legal discovery targets survey responses?
We can only hand over what we possess: encrypted blobs without the customer-held keys needed to read them. This page describes architecture facts for security review, not legal advice. Your counsel should evaluate fit for your jurisdiction and program.
Do SIEM webhooks include employee survey answers?
No. SIEM integrations stream tenant-scoped audit metadata (admin logins, poll lifecycle events, access changes), not respondent plaintext or per-response content.
How does IT provision access?
Business plans support SAML/OIDC single sign-on, verified domains, and optional SCIM 2.0 directory sync for joiner/mover/leaver workflows alongside standard workspace invites.
Is InviziPoll a certified whistleblower hotline?
No. We are not a regulated or certified hotline provider, and nothing here is legal advice. What InviziPoll gives you is an anonymous internal reporting channel with a ciphertext-only response boundary and, since August 2026, a way to write back: a reporter can take a one-time return code before submitting, and you can then acknowledge, set a case status, and reply without ever learning who they are. There is no case management, no assignment or evidence handling, and no notification to the reporter. Your counsel should judge fit for your jurisdiction and program.
Can we acknowledge a report and give the reporter feedback?
Yes, if the reporter kept their return code. They enter it on our reply page to read what you wrote and send a follow-up; the code is created in their browser, never reaches us, and cannot be recovered if lost. Each report carries a coarse status you set: received, acknowledged, under review, or closed. Nothing notifies the reporter, because we hold no address for them, so they check back with their code. Whether that satisfies a specific obligation, such as the acknowledgement and feedback periods in Directive (EU) 2019/1937, is a question for your counsel, not for us.
Can we run an always-on suggestion box?
Yes. Publish a long-lived poll with an open link or Slack distribution, pin it in your wiki or channels, and keep k-anonymity thresholds so small groups stay protected. See our anonymous suggestion box guide for program design tips.
Give speak-up a boundary your security team can verify.
Bring Security in first, or start a workspace and pin an always-on channel today.