Schweizerform vs LimeSurvey

LimeSurvey is the default survey tool at a large share of Swiss universities, hospitals and cantonal administrations, and the reason is straightforward: it is free software with question logic nothing else in this market matches, no per-response fee, and an installation you own end to end. If your requirement is a 200-question instrument with branching, quotas, randomisation and multilingual versions, LimeSurvey does that and we do not.

The comparison worth making is therefore not «which is better» but «what does each one make impossible». LimeSurvey makes it impossible for an external provider to hold your data, because there is no external provider. Schweizerform makes it impossible for anyone — including us, including a court order addressed to us — to read a response, because decryption happens in your browser with a key we never receive. Those are different guarantees, and the honest way to choose between them starts with LimeSurvey's own encryption feature, which is more often assumed than read.

How Each Product Positions Itself

LimeSurvey — the open-source survey engine

LimeSurvey Community Edition is GPL software you install on your own server; LimeSurvey Cloud is the hosted commercial version operated by LimeSurvey GmbH in Hamburg. The feature set is genuinely deep: dozens of question types, complex conditional logic and expressions, quotas, randomisation, participant tokens and invitations, panel integration, multilingual surveys, statistics and export in every format a statistician asks for. For academic research it is the reference implementation of an online survey tool, and a page that pretended otherwise would be useless to you.

Schweizerform — encrypted intake, zero-knowledge by default

Schweizerform is an encrypted intake layer rather than a research platform. Each submission is encrypted in the respondent's browser with AES-256-GCM, the submission key is wrapped to the form's public key, and the server stores ciphertext it has no way to open. Decryption happens in your browser with the Vault key, which is derived client-side and never sent to us. Encrypted submissions are stored in Switzerland at Infomaniak, one form definition publishes in EN, DE, FR and IT, and the public form page loads no third-party trackers. We can see your question text — it is stored in plain text on the server so the form can be rendered — and we cannot see a single answer.

LimeSurvey's Encryption Option — What It Does, and What It Does Not

This is the section that decides most of this comparison, because «LimeSurvey supports encryption» is technically true and widely misread. The feature encrypts personal data in the central participant database, data in survey participants tables, and individual survey responses where the question's «Encrypted» attribute is switched on. It requires the PHP Sodium library. It is a real, useful feature and it is used by serious institutions.

The part that changes the analysis is where the key lives. Per the LimeSurvey manual, the public and secret keys are found in /application/config/security.php and are generated automatically on first use of the encryption feature. In other words, the key sits in a file on the same server as the database it protects — which is the correct design for what this feature is for, and which means it protects against a stolen database dump, not against anyone with access to the server. The manual is also blunt about the consequence of losing it: create backups of the keys, because if you lose them the data becomes unusable and cannot be recovered. And once created, the keys must never be changed, or existing data becomes unreadable.

• It is at-rest encryption with an operator-held key. Anyone who can read the server filesystem can read the key, and therefore the data. That includes your administrators, your hosting provider if it is managed hosting, and an attacker who has achieved server access rather than only database access.
• It costs you searching. The manual states that partial string search is not possible on encrypted database columns — only exact-match search. Encrypt a free-text field and you lose the ability to search inside it.
• It is per-question and opt-in. Response encryption is a question attribute someone has to enable, survey by survey and question by question. The default is off, in the same way anonymisation is.
• Key loss is unrecoverable and key rotation is not supported in the ordinary sense. That is the same trade a zero-knowledge platform makes — worth knowing before it is discovered during an incident.

The Security Models Side by Side

Strip away the feature lists and there are two questions: who can technically read a response, and what has to go wrong for that to change.

LimeSurvey — you are the operator, and the trust boundary is your server

In a self-hosted install, no vendor sees your data — a real and often decisive advantage. In exchange, the confidentiality of every response rests on your server hardening, your patch cadence, your database access control and your backup handling. Responses are stored in your MySQL database, in clear text unless per-question encryption is enabled, and readable by anyone with database or filesystem access. For an institutional survey run by a research group under the same governance as the researchers, that is entirely appropriate. For a survey about the institution — harassment, management conduct, whistleblowing — the people with database access are frequently inside the population the survey is protecting respondents from.

Schweizerform — the key never reaches the server

We hold ciphertext and wrapped keys. There is no configuration, no support tool and no administrative override that produces a readable response on our side, because the material needed to decrypt is derived from a Vault key we never receive. That property does not depend on us behaving well, on our staff vetting, or on which government asks. It also cuts the other way: if you lose the Vault key, we cannot help you, and the responses are gone. The mechanism is described in zero-knowledge architecture explained.

Head-to-Head Feature Comparison

Hosting and Jurisdiction — Including LimeSurvey Cloud's Regions

This is where Swiss institutions most often discover a gap between what they assumed and what they bought. LimeSurvey Cloud offers a choice of hosting region across its plans, and the published set is Germany, Finland, the United Kingdom, the USA, Canada, Australia and Singapore. Switzerland is not among them, and the contracting party is LimeSurvey GmbH in Hamburg. A Swiss university that wants LimeSurvey with Swiss data residency has exactly one route: install the Community Edition on Swiss infrastructure — Infomaniak offers one-click LimeSurvey installs in its Swiss data centres, and Hostpoint runs its hosting on Swiss servers.

If your survey processes data covered by a professional secrecy duty or by cantonal data protection law, the residency question is only half the analysis; the other half is who can read the data once it is there. Our vendor-by-vendor Swiss residency list is in form and survey tools hosted in Switzerland, and the wider category view is in privacy-compliant survey tools compared.

The Operational Cost of Running LimeSurvey Yourself

«Free» describes the licence, not the deployment. A LimeSurvey install that is actually safe to put a sensitive survey on requires, continuously and by someone accountable:

• PHP, database and LimeSurvey version upgrades, including the breaking ones, on a cadence that keeps pace with published vulnerabilities
• TLS certificate lifecycle, HTTP security headers and a hardened web server configuration
• Database and filesystem backups that are tested by restoring them, plus safe storage of the encryption keys separately from the server if the encryption feature is used
• Access control and periodic access review — who has shell, who has database credentials, who left the institution last quarter
• Log retention, monitoring and an actual detection path for compromise, because Art. 24 nDSG requires you to notify the FDPIC as quickly as possible of breaches likely to cause a high risk
• Retention and deletion routines, because responses accumulate in a database that nobody is watching once the study ends

Under Art. 8 nDSG the technical and organisational measures are the controller's obligation, and self-hosting concentrates every one of them on you. Institutions with a professional IT department absorb this comfortably — it is what they are for. A four-person research group, a clinic or a school administration frequently cannot, and the failure mode is not dramatic: it is an unpatched instance still serving a closed survey three years later. We work through the general version of that trade-off in the self-hosted forms comparison, and the estate-management view is in digital form management for Swiss organisations.

Pricing

LimeSurvey's model

The Community Edition is free software: no licence fee, no per-response cost, and your costs are hosting plus staff time. LimeSurvey Cloud is subscription-based and metered by responses and storage — as listed in July 2026, Basic at CHF 44 per month for 1,000 responses per month and 250 MB, Expert at CHF 40 per month billed annually for 10,000 responses per year and 1 GB, Business at CHF 70 per month billed annually for 50,000 responses per year and 3 GB, and Corporate on request. Note the shape: the cloud plans meter responses, so a single large study can consume a year's allowance.

Schweizerform's model

Free, Pro at CHF 19 per month and Business at CHF 49 per month. End-to-end encryption and Swiss storage of encrypted submissions are not a tier — they are how the product works on every plan, including Free, because there is no unencrypted mode to sell you. Plans differ on volume, seats and advanced features; current limits are on the pricing page.

Which Tool Fits Which Use Case

Pick LimeSurvey when

• The instrument is complex: branching, expressions, quotas, randomisation, repeated measures, multiple language versions with different logic
• You need participant tokens, invitation and reminder management, or panel integration
• The analysis has to happen in the tool, with statistics and cross-tabs available server-side
• You have institutional IT that already operates the stack, or a hosting arrangement in which someone is accountable for it
• The survey is research with consenting participants, rather than a channel someone uses at personal risk

Pick Schweizerform when

• A truthful answer could cost the respondent something — employee surveys about named managers, whistleblowing intake, patient questionnaires, surveys of students or vulnerable groups
• You are bound by professional secrecy under Art. 321 StGB, which binds the professional and their auxiliary persons
• You want encrypted submissions stored in Switzerland without becoming an infrastructure operator
• The form is intake rather than research: applications, referrals, reports, onboarding, document collection
• You need the same form live in EN, DE, FR and IT without maintaining four instruments

When You Might Honestly Use Both

This is the common outcome at Swiss institutions, and it is a sensible one. LimeSurvey stays where it earns its place — the research instruments, the course evaluations, the longitudinal studies with panels and quotas. An encrypted intake platform takes the narrow set of channels where the content is sensitive and the respondent's willingness to be honest depends on nobody being able to trace it: the ethics complaint line, the harassment survey, the patient recruitment questionnaire, the clinical site feedback form. Two tools scoped by sensitivity is not a consolidation failure; it is the correct answer to two different problems. Where the boundary sits for research specifically is set out in data protection in clinical research — including the honest statement that a zero-knowledge platform is the wrong tool for a regulated eCRF, because monitors, auditors and inspectors must be able to read the records.

Moving a Sensitive Survey Off LimeSurvey

You are unlikely to migrate your whole LimeSurvey estate, and you should not try. The realistic move is to identify the handful of surveys that should never have been in a readable database and relocate those.

The Bottom Line

LimeSurvey is a better survey tool than Schweizerform and will remain one: deeper logic, real panel management, server-side statistics, and a licence cost of zero. If your work is survey research, install it, put it on Swiss infrastructure if residency matters, set «Anonymized responses» to Yes deliberately, and enable the encryption attribute on the fields that need it.

What LimeSurvey cannot give you — in any configuration, because of where the key lives — is a guarantee that the people running the server cannot read the answers. When that is the requirement, the choice is not between two survey tools. It is between a survey tool and an architecture.