The questions that identify without asking a name
Department, tenure, role, office: taken one at a time they look like statistics, put together they identify. In a fifty-person company, «Marketing + more than five years + part-time» is one person, and that person knows it while they're answering.
The practical rule: ask for one segmentation variable, and only if the smallest resulting group has at least ten people in it. Below that, the question has to go — not be aggregated afterwards, removed beforehand.
Required login is the loudest signal, and it has to go
If the form asks people to sign in, anonymity isn't credible whatever the introduction says — and rightly so, because technically the link exists. An anonymous internal survey goes out as a link, with no login, accepting that someone could answer twice.
It's a conscious trade: you give up the certainty of «one response per person» to get honest answers. On an engagement survey that's almost always the right trade.
Say what you don't collect, not just what you do
«This survey is anonymous» is a sentence everyone writes and nobody believes. Listing facts works better: we don't ask for your name, there's no login, we don't record IP addresses, we'll only see totals. Those are checkable claims, and one of them the respondent can check by looking at the form.
The other half of credibility is what happens next. Sharing the results — including the uncomfortable ones — is the only thing that gets answers to the second round. An anonymous survey whose results are never seen reads as evidence gathering.
Watch the open field
Open questions are where anonymity breaks by itself: someone who writes «as I already said in Tuesday's meeting» has identified themselves, voluntarily but without thinking. There's no technical fix, there's a note: remind people, next to the field, not to include identifying details.
One segmentation variable, no login, and a list of what you don't collect — anonymity is something you demonstrate, not something you declare.