Security

Anonymity as architecture

Respondent confidentiality is not a policy but a data model:

• No names, email addresses, IP addresses, browser or device information are stored with answers.
• Results unlock at 5 answers and update only in steps of 5 — a single answer can never be isolated, not even by before/after comparison.
• Comments are displayed in random order, without scores or timestamps, so a comment cannot be paired with an answer.
• The 5-answer minimum is a constant in the code — neither our staff nor customers can lower it.

Single-use answer keys

When a survey is delivered by email, each recipient receives a single-use answer key:

• Only the SHA-256 hash of the key is stored — never the key itself.
• The key is marked used the moment an answer arrives, and no link between key and answer is kept — we know someone on the list answered, never who answered what.
• Unused keys are invalidated when a survey is re-sent.

Access and authentication

• Sign-in is passwordless — a single-use email link valid for 10 minutes. There are no passwords to leak.
• Accounts require a work email address; consumer email providers are not accepted.
• Access cookies are HttpOnly, protected against cross-site requests, and bound to secure connections.

Abuse prevention

• Email delivery is technically restricted to recipients on the same domain as the account — the service cannot be used to spam unrelated parties.
• Answer submission is protected by rate limiting and single-use keys.
• No tracking pixels and no advertising cookies; analytics are cookieless and aggregate.

Encryption and hosting

• All traffic is encrypted with TLS, as are database connections.
• Data is encrypted at rest.
• The database is hosted within the EU, as is the service's compute; see subprocessors in the privacy policy.
• Access to production systems is restricted and protected by multi-factor authentication.

Reporting a vulnerability