Confidential responses: one answer per person and no way to trace it, for votes, staff surveys and more

When people are asked for an honest answer, the answer is only as honest as their trust in the process. A member who suspects their vote can be traced will not say what they think, or will not vote. An employee who suspects a "confidential" survey is not will say what management wants to hear. A panel member who knows the scores will be seen early adjusts them.

Elections are the best-known case, but they are only one. The same machinery serves any process where a known group has to give one answer each, and where who said what must stay private, at least for some of the answers. This article lists the five properties that make that trustworthy, what each one protects against, and the situations they fit.

The five properties

1. A fixed list of people who may answer

An open link can be shared, forwarded, or filled in by someone who was never part of the group. A trustworthy process starts with a list of the people who may answer, and turns everyone else away.

What it protects against: outsiders, and the same person answering under several names.

2. A personal link that works once

Each person on the list receives their own link, and it works exactly once. When they submit, it stops, and opening it again in another tab cannot add a second answer. They need no account and no password. If you issue a new link to someone, the earlier one stops working, so a forwarded link cannot be used behind their back.

What it protects against: double answers, and the cost of creating and managing accounts for people who will answer once.

3. Identity apart from the answer

The platform knows who answered, so it can tell you that, say, 41 of 60 people have responded, but it does not know what they answered. This is done in the data, not just on the screen: the record of an answer carries no name, no network address and no browser details, the time is blurred to the start of the day so it cannot be matched with the moment someone pressed Send, and the list records only that the person answered.

What it protects against: anyone with access to the data working out how a particular person answered, because the connection is not stored anywhere to be found.

4. Records that cannot be altered

Once the first answer arrives, the answers cannot be deleted, a spreadsheet cannot be imported to add more, and the shape of the form (the names, types and options of its fields) and the list of people are frozen. A label can still be corrected. Every team action on the list is written to an audit log that cannot be edited or deleted: who was added, whose link was copied, who was emailed.

What it protects against: quiet changes after the fact, such as removing an inconvenient answer, adding extra ones, or renaming an option so that existing answers mean something else.

5. Results hidden until the closing time

While the form is open, only the number of answers and the turnout are visible, with no tally, no chart and no export. The results open by themselves when the closing time passes.

What it protects against: early results influencing those who have not answered yet, and anyone with access learning how it is going.

What these are for

The properties are independent, so you use the ones a situation needs.

These combinations are suggestions, not rules. What does not change is the test: ask what you would need to prove to a sceptical member, then use the properties that prove it.

One thing to be clear about: these are features of forms, not of surveys. Forms give you counts, a comparison of one field against another, and an export of the records. Statistical analysis, such as reliability or tests between groups, belongs to surveys. And a before-and-after study is a different job: surveys match the same person across the two rounds with a respondent code, which is the opposite of what the confidential setting does, so the two are not combined.

Limits you should know

• The confidential setting is permanent for a form. Switching it off after answers have arrived cannot bring back identities that were already removed.
• A form with this setting cannot take file uploads, because an attached photo or document could identify its author.
• Hiding results needs a closing date, because the results have to open at some point.
• Once the first answer arrives, the list and the fields' names, types and options can no longer change, so test the form with a few colleagues before it opens.

A process that works

1. Agree the rules first: who is on the list, when it opens and closes, how many choices, how ties are settled, and who sees the result.
2. Load the list and test with a few colleagues before opening.
3. Send each person their personal link, by email or message, and keep a record of who received one.
4. Keep turnout visible and the result sealed until the closing time.
5. Publish the result and keep the audit log for anyone who challenges it.

In Pulseform

This is the Verified Participation feature of forms. It is made of four independent switches that map onto the properties above: an invitation-only list with a personal link for each person (1 and 2), the secret setting (3), locked records with the audit log (4), and sealed results (5). Use one, two or all four, or start from the Verified Participation template, which turns all four on and suits any use on this page, not only elections. Personal links can be emailed, copied to hand over, or sent by text message. See verified participation and sharing a form in the guide.