What to tell them about anonymity
The full argument, written to be forwarded: why the survey is genuinely anonymous and not just nominally so.
Saying «it is anonymous» convinces nobody, and rightly so: everyone has heard that before. What convinces is explaining how — so that anonymity is not a promise the company makes but something the system cannot do otherwise.
This page is written to be forwarded or adapted. The technical version, for you, is in Anonymity and minimum N.
The argument, in three sentences
There is no stored relationship between you and your answers. The system records two things separately: that you took part, and what was answered. It never joins them. This is not a permission switched off — the link does not exist.
It cannot be reconstructed from timing either. The response date is stored without a time, so «who logged in at 10:42» cannot be crossed with «what arrived at 10:42».
Small groups are not published. If an area has three people, showing its result would be showing those three. The system hides it automatically, and no role can reveal it — not leadership either.
The questions they will ask
«Can my manager see what I wrote?» No. Nobody can, in any role. What they can see is their area's result in aggregate, and only if that area has enough people.
«What if I am the only one who answers differently?» Results are published in aggregate and with a minimum number of responses. If the group is too small for your answer to blend in, that result is not shown.
«So how do you know I responded?» Because that is stored, and it is the only thing: participation. It is what makes reminders possible. But it lives on a different side of the database from the answers, and there is no way to cross them.
«Can the company that built the system see it?» No. It is not a matter of internal policy: the data is not there.
«What is the point, if nothing ever changes?» This one is not about anonymity and it is the one people actually think. The honest answer depends on you: if nothing happened last year, say so and say what is different now. If you have never measured, say when and how the results will be shared.
A short text to paste
About the anonymity of this survey
Your answers are not associated with you. The system separately records that you took part and what was answered, and stores no way to join the two — not even by time, because the time is not stored.
Nobody can see your individual answers: not your manager, not Human Resources, not leadership, not the system provider. It is not a restricted permission; the data does not exist.
On top of that, results for small groups are not shown. If few people in your area responded, that result stays hidden precisely so nobody can work out who said what.
The only thing visible is the aggregate: how the area is doing, not how each person is.
A note on placement
Do not put it at the end, in small print, next to the legal notice. There it reads as a disclaimer.
It goes at the top, in the same paragraph where you ask people to respond, and in the first person plural. The difference in participation between the two versions is large, and participation is what decides how much you get to read afterwards.