Employee Survey and Internal Feedback Forms

Every employee survey rests on a promise that the people answering it have no way to verify. The invitation says the results are anonymous. The employee knows that HR chose the platform, that IT administers the account, and that somewhere there is a database with their answers in it. Whether or not anyone would ever look is beside the point: the guarantee is a policy, and policies are written by the same organisation the survey is asking them to criticise.

Schweizerform changes what the promise is made of. Every answer is encrypted in the employee's browser before it leaves the device, and only a holder of the Vault key can decrypt it. We are a Swiss company, encrypted submissions are stored in Switzerland with Infomaniak, and we cannot read a submission — not for support, not for analytics, not under legal process, because we do not hold the key. Your own IT department cannot read them either, because there is nothing readable on the server to read. Surveys run in German, French, Italian and English, which for a Swiss employer with sites in more than one language region is not a detail.

Why Employee Surveys Are the Hardest Anonymity Problem in an Organisation

In almost every other form we handle, the person being protected is outside the organisation and the organisation is on their side. An employee survey inverts that. The person whose behaviour the survey is measuring is inside — often the direct line manager of the person answering, sometimes the head of the function that commissioned the survey, occasionally the person who administers the tool. The threat model is internal, and everyone answering knows it.

The scepticism is rational, not paranoid

Swiss employees weigh the downside precisely. Art. 336a CO caps compensation for an abusive dismissal at six months' salary, and awards in practice sit well below the cap — and the dismissal itself remains valid. There is no reinstatement. An employee who suspects that a candid answer could be traced is not weighing a lawsuit against a bad review; they are weighing a job against a survey question. That arithmetic is why participation rates collapse in exactly the teams you most need to hear from, and why the standard mitigations — a policy sentence, a vendor's assurance, an HR briefing — do not move it.

The survey is also, quietly, a health survey

The Job-Stress-Index — run since 2014 by Gesundheitsförderung Schweiz with the University of Bern and the ZHAW — put 28.2 % of Swiss employees in the critical range, with more job demands than resources, and found 30.3 % emotionally exhausted in its 2022 wave, above the 30 % mark for the first time in the series; it valued the associated loss of productivity at some CHF 6.5 billion a year. Those numbers are the reason employers run engagement surveys at all. They are also the reason the resulting data set is more sensitive than most HR teams assume: a scale asking how exhausted someone feels at the end of the working day is a question about their health.

What Swiss Law Actually Requires of an Employer Running Surveys

Art. 328b CO is the ceiling, and consent does not raise it

An employer may process employee data only where it concerns the employee's suitability for the job or is necessary for performing the employment contract. That is a narrower gate than the general proportionality rule of Art. 6 nFADP, and it is the provision that decides whether a survey question is allowed at all. The critical point, and the one most survey designs get wrong: Art. 362 CO makes Art. 328b mandatory law that cannot be departed from to the employee's detriment — the Federal Data Protection and Information Commissioner takes the position that this holds even with the employee's consent. You cannot consent your way into asking questions you are not allowed to ask.

Consent from an employee is weak by default

Both the FDPIC and the European Data Protection Board have repeatedly held that consent in an employment relationship is rarely freely given, because of the power imbalance. That does not make surveys unlawful; it makes consent the wrong load-bearing element. Participation must be genuinely voluntary and visibly so — no chasing lists, no completion rates published per team in a way that identifies who did not answer, no manager reminding an individual. The legitimacy of the exercise rests on necessity, transparency and data minimisation, not on a tick box.

Art. 26 ArGV 3: you may not build a monitoring system by accident

Art. 26 para. 1 of Ordinance 3 to the Labour Act prohibits surveillance or monitoring systems intended to observe employees' behaviour at the workplace, and it is not a rule the parties can contract around. Where such systems are needed for other reasons, para. 2 requires them to be designed so that employees' health and freedom of movement are not impaired; SECO's guidance to the article expects the purpose to be something other than behaviour monitoring, the system to be necessary and proportionate to that purpose, and employees to be informed and consulted before it is commissioned. A weekly pulse survey with per-person tracking, a named 360° tool that scores individuals continuously, or a manager dashboard that drills to one respondent are exactly the designs that walk into this article. An anonymous instrument does not.

Information and consultation duties: Art. 48 ArG and the Participation Act

Art. 48 of the Labour Act gives employees or their representation a right to be informed and heard on matters of health protection, the organisation of working time and shift schedules, and measures relating to night work. A survey about workload, stress and working-time arrangements sits squarely in that first category, which means the representation is a stakeholder in the design, not merely an audience for the results.

The Participation Act (SR 822.14) sets the frame. In businesses with at least 50 employees, staff may elect one or more representations; a secret ballot on whether to have one is triggered by one fifth of the workforce, or by 100 employees in businesses with more than 500. Art. 9 obliges the employer to inform the representation at least once a year about the effect of the business situation on employment and staff, and Art. 10 grants special participation rights in occupational safety and worker protection, transfers of undertaking under Art. 333/333a CO, mass dismissals under Art. 335d–335g CO, and affiliation to an occupational pension institution. Where no representation exists, those information and consultation rights belong to employees directly. Art. 14 binds the representatives themselves to confidentiality about the business's affairs.

Which Survey Data Is Sensitive, Who Needs to Read It, and What Drives Retention

What Changes With Zero-Knowledge Intake

Concretely: the questionnaire is encrypted on the employee's device with a key we never receive. What reaches our servers is ciphertext. When the analysis team opens a response, decryption happens in their browser with the Vault key. There is no readable copy on the server, in a support tool, in a backup, or in anything a provider could be compelled to hand over.

• The anonymity claim stops being a policy and becomes a property. «Nobody at the vendor can read this» is verifiable from the architecture rather than promised in a privacy notice.
• Your own IT is out of scope. The most common internal objection — the admin who runs our survey account sits two desks from my manager — disappears, because there is no readable data in the account to administer.
• Security appropriate to the risk under Art. 8 nFADP comes from the architecture, not only from your access policy.
• The Art. 19 nFADP information duty is discharged once, on the form itself, in the employee's own language, including what will be reported and to whom.
• Nothing is collected that you would later have to explain. No analytics provider and no beacon runs on the public form page; there is no IP address, user agent, referrer, geolocation or cookie identifier attached to a response.
• Compulsion changes nothing. A court order, a discovery request in a foreign proceeding or a determined administrator all arrive at the same ciphertext.

How Do You Give Managers Team Results Without Giving Them Individual Answers?

This is the question that decides whether an internal survey is trusted, and it has two halves: an arithmetic half and an access half. Most organisations solve the second and ignore the first.

The arithmetic half: group size, and why the threshold applies to cells

The convention that a result should not be reported for fewer than five respondents — sometimes ten — is a statistical-disclosure practice, not a Swiss legal threshold: no article of the nFADP names a number. What matters is that the threshold applies to the cell being reported, not to the survey. A survey with 400 responses is not anonymous if the report breaks down «women in the finance team» where there are three. Every filter you add multiplies the number of cells and shrinks each one. The arithmetic, with worked examples, is in how many responses before an employee survey is really anonymous.

The access half: separate the readers, not the encryption

• Put the survey in its own workspace. Only the members of that workspace can decrypt its submissions. If the works council or an external analyst is meant to be the only reader, that is achieved by who is in the workspace — not by a permission flag on top of a database everyone's admin can reach.
• Use the viewer role for people who must see but not touch. Roles run owner, admin, member, viewer, with viewer read-only, so a sponsor or a representation delegate can follow the raw material without being able to edit or delete it.
• Managers get a report, not an inbox. The team-level summary is something a human writes after decryption and above the reporting threshold. There is no way to hand a manager a filtered live view of the answers, and that limitation is doing useful work.
• Write the reporting rule down before the survey opens — minimum cell size, which breakdowns exist, who receives what, and what happens to a team too small to report. Publish it in the invitation. A rule announced afterwards reads as a rule invented afterwards.
• Every read, export and deletion is recorded. The audit log is append-only and covers logins, exports and deletions, so «who opened the responses» is a question with an answer.

Free Text Is Where Anonymity Dies

It is not the demographics that identify people. It is the comment box, and it is not close. Employees write «after my return from parental leave in March», «as the only person in the team who works part-time», «when our new department head arrived» — and each of those is an identifier written voluntarily by the person the survey is protecting. No platform can prevent this, ours included; encryption stops the vendor and the administrator reading it, not the analyst who is supposed to.

1. Say it on the form, immediately above the box. One sentence: «Please describe the situation without naming yourself, your team or individuals — we cannot make an identifying comment anonymous after the fact.» This single line does more than any technical control.
2. Never circulate verbatim comments below the reporting threshold. Paraphrase and thematise. If a comment cannot be paraphrased without losing its point, it usually cannot be shared without identifying its author either.
3. Decide in advance what happens to a comment that discloses a serious problem — a harassment allegation, a safety risk, a health crisis. You will get one. Anonymity means you cannot follow up with the author, which is precisely why an identified reporting channel has to exist alongside the survey and be named in the invitation.
4. Do not run automated sentiment analysis over free text. It cannot work here anyway — the text is encrypted and no model ever sees it — but the deeper point is that it turns a comment into a score attached to a group, and the groups are small.

One Response Per Person Without Knowing Who — and the Trap Nobody Warns You About

Every survey owner wants the same two things at once: one response per employee, and no idea which employee. The honest answer is that you can approximate it, and that each mechanism costs a measurable amount of anonymity. The ranking, from cheapest to most expensive in anonymity terms, is a device marker, then a hashed network identifier, then a one-time token, then an email address, then a login — and the spam, bots and duplicate submissions guide sets out what each one actually buys you.

The pattern that works for a workforce is «anonymous but verified»: someone who is not the analyst — the works council, an external trustee, a payroll administrator — issues single-use links or codes against the staff list, and never sees the responses; the analysis team sees the responses and never sees the list. Two roles, two sets of knowledge, and no single person holding both. It is more work than a mail merge from the HR system, and it is the only version of «one vote each» that an employee has any reason to believe.

What We Can Count Without Reading Anything

Encryption removes the answers from us, not the operational picture from you. Against the encrypted form we still count how many people opened it, how many responded, how long the median response took, and — per question — how many people who saw a question answered it. That last number is the most useful thing in a survey pilot: a question with a low answer rate is a question people are refusing, and refusal is a signal about the question, not about the person.

The design rule is that counters are flat and never cross-tabulated. Day, device, channel and question are separate tallies that cannot be intersected back toward an individual, because the cross-tab is exactly the join that re-identifies people in small response sets. Counters are also receive-time and never decremented, and there is no backfill — any product that can retroactively reconstruct perfect history kept something per person to reconstruct it from. The full account is in form analytics without tracking.

Getting Started With Employee Surveys

Running One Survey End to End

Common Objections — and Realistic Answers

We already use a survey platform and it has an anonymous mode.

Then check two things rather than trusting the label. First, whether anonymous handling is a setting that has to be switched on per collector — in the mainstream platforms it is, it is off by default, and a survey distributed by both a web link and an email invitation may need it set twice. Second, whether the setting removes the identifier from the results export only, while network addresses remain in backend logs for a period measured in months. Neither of those makes a vendor dishonest. They make «anonymous» a configuration you have to verify, which is a different thing from a guarantee.

Our provider contractually promises never to report below five responses.

That is a promise about the report, not about the data. The underlying responses still exist in readable form on the provider's systems, still exist for anyone at the provider with production access, and still respond to a lawful order. A reporting threshold protects against casual re-identification by managers, which is the most likely scenario — genuinely worth having. It does not protect against the scenario employees are actually imagining when they hesitate over the comment box.

Someone will report harassment in a free-text box and we will not be able to act.

This will happen, and it is the strongest argument for running two channels rather than one. The survey measures; a named, confidential reporting channel handles cases. Say so in the invitation, put the link next to the comment box, and accept that a genuinely anonymous survey cannot be a case-management system. We describe the boundary in the HR and whistleblower use case and in the whistleblowing platform comparison, including where a dedicated case-management suite beats us outright.

We need to cross-tabulate tenure by department by gender.

You can, after decryption, in your own spreadsheet — and you should think hard about whether you should. We cannot do it server-side: there is no query engine over ciphertext, no live filtered dashboard, no weighting, no panel management and no longitudinal linkage of the same person across waves. For a research-grade study with quotas and weighting, a specialist platform is the honest recommendation. For an annual engagement survey in a 200-person organisation, the cross-tab you are asking for is usually the one that would have identified somebody.

Our works council wants to hold the results, not HR.

That is the cleanest configuration this architecture supports, and it is worth designing for deliberately: the representation owns the workspace and the Vault key, HR receives the report, and the technical guarantee matches the political arrangement instead of contradicting it. Art. 14 of the Participation Act already binds the representatives to confidentiality about the business's affairs; the encryption makes the reverse direction true as well.

Employees still will not believe us.

Some will not, and the honest thing is to say what is verifiable rather than to reassure. What you can put in the invitation, in one sentence each: the answers are encrypted in your browser and the provider cannot read them; the survey page loads no tracker and records no IP address; the people who can decrypt are named, and here they are; results below N responses will not be reported; the raw data is deleted on this date. Every one of those is checkable by a sceptical employee with a browser's network inspector, which is more than any assurance paragraph has ever offered.

Where Schweizerform Is Not the Right Answer

• No server-side analytics over answers. No cross-tabs, no filtered live dashboards, no weighting, quotas or panels, no sentiment analysis, no benchmark database. Everything happens after decryption, in front of a person.
• No longitudinal linkage. We cannot connect the same respondent across waves without an identifier, and an identifier is the thing you are trying not to have. Trend analysis works at aggregate level, not per person.
• Not a case-management system. No anonymous mailbox the author can return to, no deadline tracking, no investigation workflow. If you need those, buy a whistleblowing platform and use the survey for measurement.
• No automatic per-form retention rule. Deletion is an action you take, individually or in bulk. Diarise it.
• Key loss is unrecoverable. Two named custodians and an offline copy, agreed before the survey opens, are a precondition rather than a footnote.
• No single sign-on, which some enterprise IT departments require before they will approve any tool. Ask us where we are rather than assuming.

The Bottom Line for Employee Survey Forms

An employee survey collects health data under Art. 5 lit. c nFADP, sits under the ceiling of Art. 328b CO that consent cannot raise, engages consultation duties under Art. 48 ArG and the Participation Act, and can drift into the monitoring prohibition of Art. 26 ArGV 3 if it is run per person and often enough. Every one of those is manageable. What is not manageable by policy is the thing that actually suppresses honest answers: the knowledge that somebody inside the organisation could look.

End-to-end encryption is the only response to that which does not depend on being believed. Answers are encrypted in the employee's browser, encrypted submissions are stored in Switzerland, the reader set is a workspace you control, and the analytics that remain are counts rather than content. What we give up — cross-tabs, weighting, longitudinal linkage, live dashboards — we would rather you know before you choose than after your first survey has already been answered cautiously.