Ask staff, and mean it.

The problems people teams actually bring

Nobody believes the survey is anonymous

Every engagement survey is answered by people asking themselves whether it can be traced back. The only answer worth anything is what the form actually collects, not an assurance that nobody will look.

Here, nothing is collected that you did not ask for. There is no automatic account capture on the respondent side. If a survey has no name, email or address question, and no identifying hidden field, then no identifying answer exists in the response. Hidden fields are declared per survey and read from the query string, so anything attached to a response is a decision you made and can describe to staff in one sentence.

The real anonymity risk in a staff survey is demographics. Department, grade, length of service and working pattern together will identify a single person in a team of eleven. Two mitigations that work: use broad bands rather than exact values, and put demographics last behind a Section break so they are visibly optional. Say in the survey what will be reported and at what minimum group size, and hold to it.

Long surveys get abandoned at question forty

An annual engagement survey grows every year because each function adds two questions. Conditional logic keeps it survivable: rules match any or all of a set of conditions, so a line manager sees the management block and nobody else does, and someone who has been in post three weeks is not asked to rate last year's appraisal. Save and continue issues a resume link keyed on a 24-character token, which matters for shift workers and anyone completing a survey between other things. Partial answers sit in a table with no row-level-security policies, reachable only through SECURITY DEFINER functions.

For layout, paged — a section per screen — is usually right for an annual survey, because progress is visible and the sections map onto the way you will report it. Conversational, one question at a time with one-tap questions auto-advancing, suits a short pulse survey on a phone. Classic, one scrolling page, is the most predictable structure for assistive technology.

Self-assessments that end in nothing

A skills audit, a wellbeing check, a manager readiness review or a policy-knowledge quiz is far more useful if the person answering gets something back. Scoring gives each choice a score and each question a weight, with an on/off flag per question, and percentage-based bands appear on the thank-you screen. Crucially, only questions the respondent actually saw are scored, so branching never costs anyone points — the person who legitimately skipped a block is not marked down for it.

That is the mechanism behind a mandatory-training check, a digital-skills self-rating that returns a level, and an onboarding readiness score a new starter can share with their manager. There is no certificate generation, so a completion record is a row in your CSV rather than something printable with a border round it. It can be a signed row, though: a signature question takes a typed or drawn mark and stores the audit record with it — the method, the exact agreement text, a SHA-256 hash of that text, a timestamp and the user agent. That is a simple electronic signature, which is admissible for most agreements. It is not a qualified signature.

Onboarding and exit forms need attachments

A new starter form wants a right-to-work document photograph; an exit form sometimes wants a handover note. File uploads go to a private bucket and are read by members of the organisation through signed URLs that expire after 300 seconds. Address questions check the postcode on entry. Date, number and email types are validated, and a custom regular expression with its own error message will validate an internal payroll or employee number format.

What it will not do: collect payment, capture a qualified electronic signature, or push anything into an HR system. Signatures here are simple electronic ones — enough for a handover note or a policy acknowledgement, not for anything that specifically requires a QES. There is no SSO or SAML, no Zapier app and no HRIS connector. Data comes out as CSV, or as a webhook: each response posted to an https URL, HMAC-SHA256 signed with a per-webhook secret, with a delivery log and the last HTTP status shown in the builder.

Who inside the organisation can see the answers

Access is by organisation. Roles are owner, admin and member, and the last owner cannot be removed or demoted, enforced at database level. Row-level security applies throughout and organisation isolation is pinned server-side rather than trusting a value from the browser. There is no per-survey permission inside an organisation, so if only two people should see the grievance-related survey, that survey belongs in a separate organisation with two members. The controls are described on the security page.

What an HR survey typically looks like

A 200-person organisation running an annual engagement survey would usually build something close to this.

1. A statement of scope as an inline heading on the first question: what is collected, what is reported, and the minimum group size for any breakdown.
2. A Recommend score — the 0 to 10 question — as the headline measure, tracked wave on wave.
3. Three Matrix questions, one each for role, manager and organisation, rating statements on one shared agreement scale. Each exports as one CSV column per row.
4. A manager branch: a single choice question on whether the respondent line-manages anyone, driving a block that only managers see.
5. A Ranking question on which three things would make the biggest difference, with answer order randomised, seeded per page load so going back does not reshuffle.
6. Two Paragraph questions — what to keep, what to change — with a maximum length and a live character counter so the answers fit the report.
7. Optional banded demographics last, behind a Section break, with "Other (please specify)" free text stored separately from the label and exported in its own column.

Distribute it with a hidden field for the location or directorate rather than asking for it, embed it in the intranet page rather than linking out, and set a close date — enforced by a database trigger, not by the interface — with a custom closed message pointing at when results will be published.

Reporting back, which is the part that decides next year

Live charts per question with response counts and completion let you watch the field period and chase the quiet department while it still matters. CSV export gives you the file for the board pack, individual responses can be browsed one at a time, and any single response prints to PDF through the browser. Free-text answers still have to be read and coded by a person — AI analysis is planned, not built.

One operational point that is easy to miss: email notifications when a response arrives do exist — you choose the addresses, and the answers are deliberately not included in the email, so respondent data stays in the database rather than being forwarded and backed up in someone's inbox. That is a convenience, not a guarantee. Email can be filtered, missed or sent to someone on leave. Never make a survey the sole route for a whistleblowing or safeguarding disclosure, and say so on the form.

Related

Education covers the student side of the same institution, healthcare goes further on information governance, and scoring and quizzes explains weights and bands in full. Back to all solutions.