enps-surveyAbout
Who runs this, and where it runs.
This service asks people to say what they honestly think of their employer. That is a great deal to ask on the strength of a domain name, so this page sets out what stands behind it: how the service is run, where the data physically sits, what these pages do and do not collect, and how to reach a person.
- Hosted in
- Switzerland
- Run by
- An independent operator
- Analytics
- None
- Third-party requests
- None
Everything on this page that can be checked against the running service — the headers, the cookies, the absence of third-party requests — can be checked from your own browser's network tab in about a minute. That is the intended way to read it.
An independent service, not a product with a sales team.
enps-survey.org is run independently and paid for by people who use it. There is no advertising on it, nothing about it is sold on, and there is no second business model underneath the first one.
It is deliberately small.
Six API endpoints, one employee questionnaire, and no dashboard. Your own application does the driving, which is what keeps your staff list on your own systems. Nothing here schedules anything, sends anything, or reminds anyone.
And its role is a narrow one.
Your employer decides who is invited, what the groups are and what is done with the result. This service holds the answers and hands back figures for groups. In the language of data protection, the employer is the controller and this is a processor acting on their instructions.
Hosted in Switzerland, on hardware the provider owns.
The application and its database run in Switzerland, on ISO 27001-certified infrastructure owned and operated by a Swiss provider — their own data centres, not resold capacity inside somebody else's cloud, and no American sub-processors in the chain. That last part carries more weight than it reads: there is no foreign parent company through which an overseas disclosure order could reach the hardware.
The provider is named on request, not here.
What a reader needs is the property — Switzerland, certified, owned outright — and that is stated above. Registered callers who need the name can have it, along with the current sub-processor list and the processing terms that go with it, by asking.
Transfers from the EU need nothing extra.
Switzerland holds an adequacy decision from the European Commission, so personal data moving here from the EU or the EEA does not require standard contractual clauses or any other additional safeguard.
Being hosted in Switzerland is not immunity from legal process, and this page will not pretend otherwise. Switzerland has its own rules on lawful access and this service is subject to them like any other. What Swiss hosting rules out is a second jurisdiction laying claim to the data by virtue of who owns the company that owns the servers.
Though the better guarantee is how little there is to place under any jurisdiction.
Where a survey platform would normally hold a staff roster, this one holds none. No names. No email addresses. No IP address of anyone answering, no record of when an answer arrived, and no link of any kind between an answer and the invitation that produced it. Employers send the invitations themselves, from their own systems, so the mapping between a person and a link never reaches us — not because it is deleted, but because it is never sent.
Which makes jurisdiction the second line of defence here rather than the first. An order compelling disclosure, filed wherever you like, cannot produce a column that does not exist.
No analytics, no tracking, and nothing loaded from anywhere else.
Every stylesheet, script, font and image on this site is served from this domain. There is no analytics of any kind, no tag manager, no advertising pixel and no session recorder. The content security policy these pages are served with begins default-src 'none', which means a page here is not permitted to fetch from a third party even by mistake.
Cookies, in full.
Pages carrying a form set one session cookie, used only to prove that the form was submitted from this site and not from another one. The questionnaire stores a language cookie if a reader changes the language by hand. That is the complete list, and neither identifies anybody. Pages you can only read — this one included — set nothing at all.
Crawlers are asked to stay away from the questionnaire.
Invitation links carry a code, and a code in a crawler's request is a code in a log file. So robots.txt asks crawlers not to fetch them at all, and every application page carries a noindex directive. This binds only the crawlers that choose to obey it, which is why the links are single-use as well.
Getting in touch.
One person reads this mailbox. Security findings get a reply; everything else gets one when it can. Please do not send personal data of any kind — least of all an employee's — in an email to it.
Write about
A security finding. A request for the sub-processor list, the name of the hosting provider, or the data-processing terms. A question about how the suppression thresholds behave on your data. Anything on this site that is wrong.
admin (at) enps-survey (dot) org
Two things this mailbox cannot do.
It cannot recover a lost access token. Tokens are stored only as a hash, so nobody here has yours to send you — issue a new one instead. And it cannot tell you who gave a particular answer, or which of your employees have replied. That is not a policy that could be waived for a good reason; it is an absence of data.
If you were invited to a survey.
Your employer is the one who can answer questions about it. They decided to run it, chose who was invited and which group labels the answers are reported by, set when it opened and closed, and they receive the results.
The question itself is not theirs. Every survey run through this service asks the same one, in the same words, with only the employer's name filled in — nobody can commission a differently worded version. What this service can tell you is exactly what it stores about an answer, and that is set out on the anonymity page. There is no need to write here, and a reason not to: an email about a survey creates a link between you and it outside the database, which is precisely what the database is built to avoid.
Ask the question this quarter.
Registration takes a minute and gives you a token. Everything after that is six endpoints and your own code.