Verified Participation

Open a form's Settings → Participation tab to see and toggle each one.

Switch	What it does
Invitation-Only Roll	Only people on the participant list can respond. Everyone else is turned away.
Secret Mode	The platform knows who answered; it cannot say what they answered.
Sealed Results	Results are hidden until the form's closing date passes.
Locked Records	Responses, question options and the roll are frozen once the first answer arrives.

They are independent. Use one, two, or all four. The only constraint is that Sealed Results requires the form to have a closing date — the seal needs somewhere to lift.

---

Invitation-Only Roll {#invitation-only}

The form's Participants & Invitations page holds the roll — the list of people who may answer. When Invitation-Only is on:

• The form's public link redirects to a closed message for anyone without a personal invitation link.
• Team members who open the form inside the platform also see it as closed.
• The offline Collect app and the JSON submission endpoint both refuse it.

Each person on the roll is issued a personal link: a unique URL that opens the form pre-authenticated for them. That link works exactly once. The moment they submit, it stops — a second tab opened from the same link cannot add a second answer.

Adding people to the roll: from the Participants page, add one person at a time or paste a list of names, emails, phone numbers and reference codes, one line per person. Emails and reference codes must be unique within the roll.

Issuing personal links: from the Participants page, click Email Link to send a personal link by email, or Copy Link to copy it yourself and hand it over another way. Both actions are recorded in the audit trail. Issuing a new link — by email or copy — revokes any earlier link that person held.

Note Once a locked form receives its first response, the roll is frozen. Adding or removing a participant at that point could change who is able to answer, so the platform prevents it.

---

Secret Mode {#secret}

When Secret Mode is on, the platform deliberately loses the link between a person and their answer:

• Submission records carry no name, no IP address, no user-agent string.
• The timestamp on each submission is moved to the start of the day, so a time cannot be matched against the moment a participant clicked Send.
• The participant roll records only that the person answered — not when.

This separation happens in the database, not just in the UI. There is no column to unhide, no join to run that would reconnect the two halves. The roll and the submission table share no key.

Warning Secret Mode is permanent for a given form. Switching it off after responses have arrived would not recover the identity already removed from those submissions.

Secret Mode is incompatible with file-upload fields (an attached photo or document could identify its author). Adding one while Secret is on raises a validation error.

---

Sealed Results {#sealed}

With Sealed Results on, the submissions screen shows only:

• Response count — how many submissions have arrived so far.
• Turnout — what percentage of the roll has responded.

No tally, no chart, no per-response detail. Attempting to export a CSV or analytics PDF is refused with a 403.

The seal lifts automatically when the form's expiration date and time passes. From that moment the full results screen opens normally.

Note A form with Sealed Results must have a closing date. Without one, the results would be sealed permanently.

A form that has already closed (its expiration is in the past) cannot be reopened while Sealed Results is on — extending the closing date would give early viewers of the tally extra time while late voters still hadn't answered.

---

Locked Records {#locked}

When Locked Records is on, three things are frozen once the first response arrives:

1. Submissions cannot be deleted.
2. CSV import is disabled.
3. Answer shape is frozen — the names, types and options of every field are fixed. A label can still be corrected, but renaming a candidate or adding a new option changes what the existing votes mean, and the platform prevents it.

The lock itself cannot be removed once voting has started. Turning it off after responses arrive would re-open all three of the things it was there to close.

---

All four switches together form a secret ballot. Rather than toggle them one by one, open New Form, choose the Verified Participation template, and all four are turned on in one click along with a sample ballot question. The template suits any use on this page, not only elections: replace the sample question with your own.

You can also apply the preset to an existing form: open Settings → Participation and click Election mode. This turns all four switches on and moves you to the settings tab so the closing date — required for Sealed Results — is the first thing you set.

---

The Participants & Invitations page (reachable from the form's header menu) is the control room for the roll:

Column / action	Meaning
Invited	A personal link has been emailed or copied for this person
Responded	They have submitted an answer
Email link	Send a fresh personal link by email. Any earlier link stops working.
Copy link	Copy the link to hand over yourself. Recorded in the audit trail.
Send link by text message	Text a fresh personal link to the person's mobile number, paid from your SMS credit. Any earlier link stops working.
Remove	Remove a person from the roll. Only possible before the first response on a locked form.

Use the Email all pending button to send links to everyone who has an email address and has not yet been invited.

To send links by text message instead, use Text all not invited. Texts are paid from your SMS credit, and you see the number of people and the estimated cost before sending. See SMS credit.

Audit trail

Every team action on the roll is recorded in a log at the bottom of the Participants page: who was added, whose link was copied, who was emailed. The log is append-only — entries cannot be edited or deleted, including by team admins.

---

The four switches are not exclusive to elections. Any situation that combines we need to know who participated with we cannot let the answer be traced back benefits from them.

For beneficiaries and stakeholders

Use case	Which switches help
Beneficiary satisfaction surveys	Secret: respondents give honest answers when they cannot fear losing assistance. Invitation-only: each beneficiary responds once.
Stakeholder opinion surveys	Invitation-only: only the intended partners or beneficiaries are counted; outsiders cannot skew the results.
Pre- and post-project measurement	Personal links allow comparing the same person before and after without revealing their identity to the analysis team.

Inside an organisation

Use case	Which switches help
Employee satisfaction and workplace surveys	Secret: staff write honestly when they know management cannot identify their answers.
360° performance reviews	Secret + invitation-only: each reviewer is on the list, each reviews once, and the subject cannot identify who said what.
Whistleblower and incident reporting	Secret + locked records: identity is protected, and submitted reports cannot be quietly removed.
Board or general assembly voting	All four: the quorum is proven by turnout, each member votes once, the ballot is secret, and results are sealed until voting closes.

Competitions and assessments

Use case	Which switches help
Grant or competition judging	Invitation-only + sealed results: each panel member scores once; results stay sealed until all scores are in, so no judge is influenced by the others.
Training assessments	Invitation-only + locked records: each trainee gets their own link; the question set cannot be changed mid-assessment.

---

Verified Participation is about who fills the form and what the platform retains. It does not:

• Verify a person's real-world identity. If someone gives a wrong name or email when added to the roll, their link works the same way.
• Provide legal non-repudiation. For legally binding votes, consult your jurisdiction's requirements.
• Replace a dedicated e-voting platform for large-scale public elections.

For internal organisational processes — staff surveys, board votes, programme evaluations — it provides a level of privacy and traceability that general- purpose form tools do not.

---

1. Build a form
2. Form settings: limits, access and rules
3. View and export records