TRUST, EXPLAINED PLAINLY
Who sees what?
Your eligibility, your answers and your employer’s report are handled separately.
Confirm eligibility
We use the invited email address to send a one-time code. After verification, your browser obtains a blind-signed survey pass. The eligibility record says only whether a pass was claimed; it does not contain your usable pass.
Share your experience
Your answers are stored in a separate database without your email address. A spent-pass ledger prevents repeat submissions but is not stored against an answer record. We do not ask for respondent names or departments, or keep application-level IP/access logs. Optional written responses are read only by designated EmployerScore reviewers. Distinctive details in comments can identify people even without names; avoid details you are not comfortable sharing.
Report the overall picture
Employers receive reviewed aggregate findings, not individual answer rows. Production campaigns require at least ten usable respondents for every metric.
Important limits
Confidentiality also depends on your device, email account, network and the hosting environment. An employer may monitor a managed device or work mailbox. Blind signing protects the credential exchange; it does not make a compromised device safe or remove all traffic-timing risks.
Your device and survey pass
Your pass and unfinished answers stay in this browser until you submit or clear them. Use a private device where possible. Save your pass securely if you need to change devices. Once issued, a lost pass cannot be replaced without risking a second response. Interrupted issuance can be retried on the same device with the same verification code before it expires.
Retention
Verification challenges expire after ten minutes. Live email message bodies are removed after successful delivery; delivery metadata is retained for a short operational window. Campaign rosters and individual answer data are scheduled for deletion 90 days after the campaign closes. Released aggregate reports are retained. Managed database recovery history may retain deleted data temporarily.
Questions before participating
If you are unsure about the campaign, ask EmployerScore before submitting. Employers receive group-level findings and privacy-reviewed summaries, not raw comments. Concerns are reports, not established facts. This survey is not continuously monitored or an emergency or investigation service. Contact EmployerScore.
Website enquiries
Contact-form submissions are not anonymous survey responses. We store the name, organisation, email address and message you provide so EmployerScore can respond. These details are also emailed to our configured enquiry mailbox through our email provider.
Please do not include a survey pass, verification code or sensitive survey answers in an enquiry. To ask about your information or this process, contact EmployerScore.