Designing Privacy-Preserving Employee Surveys

A survey does not become anonymous because you remove the name field. That is probably the most important architectural lesson in this kind of system. An employee may submit a form containing no obvio