Anonymity

A promise of anonymity is worthless if the system is technically able to break it. So here anonymity is a construction, not a policy.

Two separate registers

The dispatch register knows who was invited and whether an answer arrived. The response register holds the answers. No relation exists between them.

Links without a key

Only a hash of the link is stored. The link works once. After use it can neither be recreated nor reopened.

The threshold of five

A unit with fewer than five responses is not reported. The threshold is enforced in the database function, so it cannot be switched off in the interface.

No order to trace

Answers are stored with a random sort key, so it is impossible to infer who answered when.

Anonymisation rather than deletion

When an organisation leaves, identity is removed. The numerical basis may remain in the norm base if consent was given.

We cannot tell a manager who answered what. Not because we will not, but because the information does not exist anywhere.