where data quality matters.
Online survey-based research has always had to contend with fraudulent and ineligible responses, but now bots, click farms and malicious AI agents can submit without being detected, poisoning the results. It is increasingly difficult to produce online survey data that can be trusted. But unless the research is merely performative, that is the whole point of the endeavor.
What Septenar does about itfor people who care about privacy.
The most meaningful data a researcher can collect is often the most dangerous for the people providing it. The possible repercussions of a data leak, where sensitive personal information is concerned, could affect safety, careers, health, personal relationships. The risk doesn't go away just because the data is stored "carefully". It goes away when there is nothing stored that could identify those people: Septenar can run a survey where no email addresses, no IP addresses, and no links between people and their answers are stored. Authentication is still required; but the data that could make them identifiable simply isn't kept.
Ways to protect participantsthat works in multiple languages.
Canada answers in many more languages than its official two. A survey can be offered in the languages its participants actually speak — Punjabi to Tagalog — and every response lands in one dataset, whatever language it arrived in. People answer best in the language they think in; the ones who can't often quietly opt out.
Surveys in many languagesbuilt for compliance and data sovereignty.
In Canada, that means your data and your records stay on Canadian infrastructure, and the privacy law that governs your research is enforced by the platform: Quebec's Law 25 is a setting on an application, and choosing it switches on the consent rules, retention limits, and audit trail the law requires, with the privacy impact assessment it expects built in as a workflow. Nothing is stored outside the country, so the platform itself never triggers a cross-border assessment; the AI that analyzes responses stays in Canada too, and never trains on what people tell you.
On compliance and sovereigntyfor frugal people.
You're charged for one thing: a question a participant actually answered. Ten questions, a thousand complete responses — ten thousand credits. Questions people skip cost nothing, and a survey that's built but never launched costs nothing. On paid plans, credits you don't spend carry forward, so a quiet spring pays for a busy fall.
What things costthat you can make your own.
Make a survey unmistakably yours — your colours, your logo, your wording, your sending address. Participants see your organization, not ours: on a hosted page there is no trace of the platform, and on your own website a single line names who processes the data, which the law wants there. Your own address, like research.yourorg.ca, is planned — not yet live.
About branding & hostingOpen survey links, ballot-stuffing, five-cent respondents — and what it costs, in both directions, to know that your data came from people.
Three thousand open-ended responses, a button that promises insight, and the difference between analysis you can audit and analysis you can only believe.
How modern privacy regulations are reshaping survey methodology — and why that's a good thing for everyone.
Septenar keeps bad data out to begin with, by requiring every participant to authenticate. The alternative, detecting bad data once it is already in the results, is a losing proposition, and the evidence for that is now extensive.
When a team of researchers audited two of their own open surveys of California producers in 2024, 560 of 1,540 responses to one and 627 of 1,616 to the other proved fraudulent, and of the 31 fraud indicators they tested, none caught more than 60 percent of it without discarding 15 to 20 percent of the real participants. Attention checks were passed by 83 percent of the fraudulent respondents and 82 percent of the genuine ones. Their review of the field puts fraud in open online surveys at around 80 percent of responses, up from 14 to 18 percent a decade earlier. A year later Sean Westwood of Dartmouth published, in PNAS, an autonomous synthetic respondent: a language model holding a demographic persona and a memory of its own answers, which passed 99.8 percent of 6,000 standard attention checks, solved the logic puzzles set to trip it, and could be instructed to tilt a poll, or to infer the researcher’s hypothesis and confirm it. His conclusion is that most current detection methods are obsolete. The longer account, with its sources, is in Who Is Answering Your Survey?.
Septenar offers three authentication strategies, suited to different research situations. Each ends in a credential: an email address the participant proves they control; membership in a participant group you assembled, proven the same way; or a single-use access code, handed out on a printed card or as a QR code. The credential admits its holder to the survey once and only once. A forwarded link admits no one by itself. Whoever follows it still has to present a credential, so a link passed around cannot produce a second response from the same person, and on the two restricted strategies it cannot produce a response from anyone you did not invite.
Once a survey or a poll is published, its instrument is immutable. Questions, options, order, scales and consent text, in every language, are frozen, and the freeze is enforced where the data is written, not only in the editor. The questions participants answered in week one are exactly the questions in the data export in week six. Revisions go into a new survey, with its own dataset.
The Library holds 36 validated instruments, standardized questionnaires whose wording and scoring were established in published research so that results compare across studies, the PHQ-9, GAD-7, K6 and RAND-36 among them. Each is added as its authors published it, wording, options and item order locked, and scored deterministically: the same answers produce the same score every time, with no model involved.
You can see where people gave up. The engagement view reports time spent per question, where participants abandoned, and the paths they took through the survey: the signals that say a question is confusing before an analysis is built on it. Under Law 25 or HIPAA these are withheld for any question fewer than a minimum number of people reached, so the view never singles anyone out.
There are things Septenar does not do. There are no attention checks, no speed traps and no detector for machine-written text. The two studies above are a fair account of how well those work. A credential proves that someone controlled the inbox or held the code, not that a particular person was on the other end of it: an AI agent with access to an inbox can complete the flow, and a participant can hand their code to someone else. What authentication changes is the cost and the count. Polluting a study means obtaining credentials one at a time, and each pool reports how many codes were issued against how many were used.
The research that most needs honest answers is often the research people hesitate to be involved with. Questions about harassment, substance use, food insecurity, or mental health ask each participant to weigh a private risk: what happens if this answer is ever connected to me? Some decide not to answer — and they are rarely a random sample. The people with the most at stake go missing first, and the data quietly bends. Researchers know this as nonresponse bias.
Septenar's answer is to let a survey collect less identity — structurally. A privacy policy describes how identifying data will be handled. A survey that never keeps that data makes the question moot: what isn't stored cannot leak, cannot be breached, and cannot be handed over.
Anonymous access codes. Printed single-use codes — in a sealed envelope, on a card, at a clinic — stand in for identity entirely. A participant enters the code and answers. Nothing about the participant is stored with the response — no email, no IP address, no name; the platform keeps only a cryptographic digest of the code itself. (A source address is held for five minutes to throttle code guessing, and no longer.) The tradeoff is real and worth knowing before you choose it: with no identity anywhere, there is no way to follow up with a participant later.
Verified, then discarded. Often deduplication matters and identity doesn't. A participant confirms their email; the platform converts it to a keyed one-way token, uses the token to enforce one response per person, and discards the email — never written to a database or a log. Every survey has its own key, and when the survey closes, the key is destroyed. After that, the tokens can never be traced back to anyone — including by us.
Verified and kept — when that's the purpose. Longitudinal research needs to reach the same people again; there, identity is the purpose, and email-verified participation is the proportionate choice. That's the principle Septenar applies throughout — Quebec's Law 25 (sections 5 and 9) calls it proportionality: collect the least identity that achieves the research purpose, and no more.
Anonymity here never means an open door. Every mode still authenticates — codes are single-use, emails are verified before they're discarded or kept — so a response that carries no identity still came through a credential the survey issued. Knowing that, and knowing nothing else, is the point.
Who on your team sees what. The same principle governs your own team's access. Owners and administrators manage the account; everyone else is granted access application by application. A translator sees the survey's text and nothing a participant wrote; a client sees aggregate results, with no individual response and no participant list; a developer builds, and reads results, only in the applications they've been given. At the Law 25 and HIPAA levels, every change to the team — an invitation, a removal, a change of role, a transfer of ownership — is written to the audit trail; at the PIPEDA baseline, there is no such trail.
Full mechanics in the guide: Collecting Sensitive Data Anonymously
In the 2021 census, 4.6 million people — one in eight — reported speaking a language other than English or French most often at home. Research in Canada meets them constantly: the person who could answer thoughtfully in Punjabi or Cantonese answers approximately in English, or quietly closes the tab. Language is one of the oldest ways a sample goes wrong. The people it removes aren't randomly distributed, and no weighting scheme recovers the voices that never arrived.
A survey on Septenar carries all of its languages in one instrument. Answers are stored against the question itself, not its wording, so a response given in Tagalog and one given in French land in the same dataset, side by side — nothing to merge, nothing to reconcile afterward.
Chosen for Canada. Surveys can currently be offered in English, French, Spanish, Punjabi, Mandarin, Cantonese, Tagalog, Arabic, Italian, and German — a list that follows the non-official languages Canadians most often speak at home. Participants choose their language on the survey itself, or arrive through a link that already speaks it.
How many, and what it costs. How many languages a survey can carry follows the plan — two on Evaluation, three on Basic, seven on Core, no limit on Advanced — and the default language counts as one. Serving a response in a language other than the default adds a tenth of a credit per answer; everything else costs the same in every language.
Machine drafts, human judgment. Adding a language produces a complete machine translation in moments — as a draft, not a deliverable. The workflow assumes a person reviews it: invite a translator, and they see the translation workspace and nothing else — no responses, no participant data. If the source text changes later, affected translations are flagged as stale rather than drifting silently.
Consent is translated too — and reviewed the same way. Everything on the consent page — your heading and explanation, the platform's own sentences, each optional consent, the two buttons — is part of the survey's text, so it takes the same machine draft, the same review and the same stale flag as every question, and its segments carry a warning that the text has legal implications. A survey cannot be published in a language whose consent page is incomplete: consent never falls back to another language. What is published in each language is what the participant reads, word for word, and what their consent record stores, with the hash of that text and the language it was read in; the same text appears in the participant's portal, in their data export and in the ethics-board package. Where Quebec participants are in scope the survey opens in French unless the participant has already chosen a language, and the record shows the switch. What the workflow doesn't do is stop you from publishing a machine draft: it warns, names the languages, and leaves the decision with you. Have a person read the consent page in every language before you publish.
The platform itself — the side researchers work in — speaks English and French. The survey languages are for participants, and that's where they do the real work: each response arrives in the language the participant thinks in, including from people who, in an official-languages-only survey, would never have arrived at all.
Full mechanics in the guide: Conducting Multilingual Surveys
For most research, compliance is the obligation and everything else is preference. In Quebec, Law 25 sets penalties of up to $25 million or 4 percent of worldwide turnover, gives individuals a private right of action, requires a privacy impact assessment before high-risk collection, and gives you 72 hours to notify the Commission d'accès à l'information of a breach. Elsewhere in Canada the baseline is PIPEDA, with Alberta and British Columbia adding acts of their own that the same baseline satisfies. And whichever law applies, an ethics board or a funder will ask to see the consent record, the assessment, and the audit trail — documents that are otherwise assembled by hand, after the fact.
In Canada, that means compliance is a property of an application, not a checklist beside it. Every application declares a level — PIPEDA as the baseline, Law 25 for Quebec or for anyone who wants the stricter standard, HIPAA when US data residency ships — and every survey inside it inherits the rules.
What Law 25 switches on. Consent is granular and per purpose, with no pre-checked boxes and equal weight to accept and decline. Retention periods are enforced by the platform — data is deleted or anonymized on schedule, not when someone remembers. Every submission, export, consent event, and deletion writes to an audit trail kept for a year. Survey results cannot be made public. A privacy impact assessment is required before a sensitive survey publishes, anonymous access codes are recommended wherever identity isn't the point, and a breach runs on the statutory clock. Law 25 is available on Core and Advanced plans.
The agreements, matched and signed. Which processor agreements your research needs — a PIPEDA data-processing agreement, Quebec's outsourcing agreement, an information-manager agreement for health custodians in Ontario or Alberta, the TCPS 2 addendum for research — follows from the application's sector and participant jurisdictions. They are signed in the platform in one sitting, the executed PDFs are kept, and a survey won't publish until every agreement that applies has been. The templates carry a draft watermark until counsel review completes.
Where the data lives. Septenar runs in one place: the AWS Canada Central region, in Montreal. Every system that holds customer or participant data is there — the databases, the queues, the file store, the cache, the email sender, the logs, and the models — and an organization-level guardrail denies the platform's own credentials the ability to create anything anywhere else. Law 25 section 17 requires a written assessment before personal information about Quebec residents is communicated outside the province; the platform itself never triggers one.
The AI stays too. Survey drafting, response scoring, translation, and theme discovery run on models hosted in the same region, through Amazon Bedrock and Amazon Translate, on contractual terms: nothing you or your participants write trains a model, nothing is shared with the model's maker, nothing is retained after the call. The cost is one you'd notice — newer models often reach Canada later than the United States, and the platform waits rather than route a prompt through a US region for the newest one.
What crosses the border, exactly. Two things, both on the public register. Billing — the account holder's name, email, and card — is processed by Stripe in the United States; no participant data goes there. And the edge network that answers a browser's request is global: a participant's connection terminates at the nearest edge and is relayed to Montreal, and nothing a participant submits or uploads is stored at an edge. For a participant in Canada, that edge is normally in Canada.
Residency is not the whole of sovereignty — and that part is a question, not a rule. No regulator will fine you for the cloud your platform runs on. But some partners will ask, and research governed by OCAP® principles asks first: the data centres are operated by AWS Canada, a subsidiary of a US company, and US law — the CLOUD Act — can in principle compel a US company to produce data it controls wherever that data is stored. AWS has committed publicly to challenging requests it considers unlawful and to notifying customers where it is permitted to; Septenar will pass any such notice on to the affected account. That residual is real, it is named in the platform's own assessment, and removing it entirely would take a Canadian provider with no US parent — which Septenar does not claim to be.
The sub-processor register — three entries, with the section 17 assessment for each
Research budgets are mostly small and mostly fixed. A grant has a line item; a community organization has a board-approved number; a program evaluation has whatever was left after the program. So the frugal question is the one worth answering plainly: what will this actually cost, and is any of it paying for things you don't use?
Septenar charges for what you use, and doesn't charge for what you don't. The things that use credits are the things that cost something to run — processing, storage, the occasional obligation a regulator imposes. The price follows the cost.
The unit is one answered question. A 10-question survey that collects 1,000 complete responses uses 10,000 credits. Questions a participant skips cost nothing, and a survey that's built but never launched costs nothing — the meter runs on data that actually arrives. A few features that do extra work — serving a translation, AI-scoring a text answer, sending a campaign email, running theme discovery — add small flat surcharges, each a fraction of a credit, itemized in the guide.
On paid plans, unused credits accumulate. Credits arrive every month, and what you don't spend carries forward — up to sixty months' worth — following you if you change plans in either direction. A quiet spring can pay for a busy fall. And when a balance does run out, collection continues at the plan's per-thousand rate up to the account's spending limit, and stops exactly there. If the work stops for a season, you can pause the account — billing stops with it, and the balance holds until you resume.
Evaluation is for evaluating. The free tier is named for its purpose. It never expires, needs no payment card, and gives 500 credits a month that reset rather than accumulate — enough to build real surveys and collect real responses, and deliberately not enough to run a research program on. When its credits are spent, collection pauses until the month turns; no one is ever charged. Evaluation forms are also rate-limited to a thousand answers an hour, so an accident can't burn the month in a minute.
Compliance costs what compliance costs. An application at Quebec's Law 25 level weighs each answer at 1.3 credits; HIPAA, 1.5. The multiplier pays for what those regimes require the platform to actually do: retain data longer, write an audit record of every submission, export, consent, and deletion — under HIPAA, of every access — and keep what a privacy regulator may ask to see years from now.
You can put a ceiling on it. A paid account's additional usage stops at a spending limit, 5 months of the plan's included credits unless an owner changes it, and an application can have a monthly limit of its own. Alerts arrive at 80 and 95 percent, and a survey's settings show the exact credit cost of each submission before you publish. Helping you not spend is part of the product.
A survey arrives with a sender and a look, and participants decide in the first second whether it comes from an organization they know. A link that looks like a third-party tool, from an address they have never seen, gets deleted — or reported as phishing. Communities that have been studied before, and not always kindly, are right to be wary; for research that took months of trust to arrange, that first second can be the whole study.
Septenar's default is that the participant sees you.
Your brand, on every surface. A brand kit carries your logo, your colours in light and dark, your typeface, the corner radius and page style, and a hero image; it applies to the survey pages, the welcome and thank-you, and the invitation emails, and each survey's wording is yours throughout. The "Powered by" line can be turned off. Brand kits, your sending address, and that switch are available on every paid plan; the free Evaluation plan keeps the platform's look.
Your address on the email. Invitations and reminders can go from a subdomain of your own domain — surveys.yourorg.ca — verified the way any mail system is, through DKIM, SPF and a mail-from record, with the DNS entries generated for you to paste. All paid plans.
Where it runs. A hosted page on septenar.ca; a web component you paste into any site that accepts a snippet; a WordPress plugin; an iframe for systems that allow nothing else. On your site or off it, it is the same survey, and the results land in one place. React and server-side SDKs come with Beta.
The one line that stays. On your own website, participants lose the address bar's signal of who is handling their data, so one line remains beneath the survey: responses are processed in Canada by Septenar, with a link to the public sub-processor register. It survives every branding setting. The law wants it there, and so would a careful participant.
Your own address is planned, not live. A survey at research.yourorg.ca — your domain in the address bar, not ours — is built on the builder side and waits on the production plumbing. When it ships, serving a survey through it will add a fifth of a credit per answer.
Septenar makes two kinds of form. A poll is a short list of countable questions, 10 at most, and its result is a tally: how many chose each option, where the ratings fell. No one, you included, sees how any one participant answered, and a poll keeps no personal data by default. A survey is pages of questions, opened by a consent step and able to branch on earlier answers, and its result is a record per participant that you can read, export and follow up on, with a reminder or a second wave. The choice usually turns on one question: do you need the totals, or the individuals?
Which one you need, worked through in the guide: Surveys and Polls
A survey can ask 15 kinds of question: single or multiple choice, a dropdown, yes or no; a rating scale, a slider, a number, a date; a ranking, a grid of items against one scale, a fixed total to divide among options, a postal code or region; a short or a long written answer; a file. A poll takes the countable ones: a choice, yes or no, a scale, a ranking.
Some questions should not be written fresh. When a study needs to measure something like depression, anxiety, or how a person rates their own health, researchers reach for a questionnaire whose questions, response options and scoring were settled in published research and have been given to many thousands of people since, so that a score means the same thing in your study as in anyone else's. The field calls these validated instruments. The PHQ-9 is one: nine questions about the past two weeks, each answered on the same four-point scale, summed to a score from 0 to 27 with published bands from mild to severe depression, and in use in clinics and studies since 2001.
The Septenar Library holds 36 of them, ready to add to a survey: the PHQ-9 and the GAD-7 for depression and anxiety, the K6 for psychological distress, which Statistics Canada has measured across the Canadian population, the RAND-36 and the WHOQOL-BREF for health and quality of life, the AUDIT-C for alcohol use, among others.
An instrument added from the Library arrives as its authors published it, and stays that way: wording, options and order are locked, and scoring follows the published rules, the same answers producing the same score every time, with no model involved. 31 of the 36 need no licence; for the rest, the platform says what the licence requires and records your attestation. French versions use the published canonical translation where one exists, and where we translated in-house the translation is labelled as ours. When an instrument is revised, a published survey keeps scoring against the version its participants answered.
Instruments go in surveys, not polls. And the Library does not bend: an instrument that does not fit your study cannot be edited into one that does, though its questions can be copied out as ordinary questions, unlocked and unscored.
Some of this is genuinely hard to get right — which privacy framework applies, when a study needs an ethics review, how to reach people who won't hand over an email. The guides work through those decisions in plain language, before you build anything. They're free, open to anyone, and written for the person doing the work.