Joripo- Home
- Documentation
- Security and privacy
- Identity access and privacy
Security and privacy
Identity access and privacy
Marking the questions that identify a respondent, what everyone without identity access sees instead, who has identity access, and the identity map.
Joripo documentation · https://joripo.com/docs/security-and-privacy/identity-access
On this page
Most people who work with a survey's data do not need to know who each respondent is. A workspace's Privacy page marks the questions of each form that identify someone (a name, a phone number, an address, a household's GPS point, a photo of the respondent) and says what everyone without identity access sees instead.
What people without identity access see
| Choice | What they see |
|---|---|
| The answer as given | The answer: the question is not protected. |
| A pseudonym | A stable pseudonym, P and ten characters, the same for the same answer in every export and every form of the workspace, so rounds and forms still link without the identity. |
| Nothing | An empty cell; a photo, recording or file is withheld. |
| A rounded location | For GPS: the point rounded to two decimals (about 1 km), with altitude and accuracy dropped. |
Joripo suggests questions whose names usually identify someone (name, phone, address, gps, hhid, photo and the like); you decide.
Where it applies
The stored data never changes: the server keeps every answer as it was given. What changes is every way the data leaves the server for someone without identity access: every export file, the Data Explorer and its search, the submission page, attachments one by one and in zips, the data API, Joripo Desktop, quality-finding text, field-monitoring dashboards and tracksheets. A corrected answer to a protected question is masked like the one it replaced.
A dashboard filter that could single out one respondent's protected answer (a text search, a narrow range) is refused.
Who has identity access
- Owners, always.
- Managers and reviewers an owner gives it to, workspace by workspace, under Who sees respondents as they are on the Privacy page. Every grant and removal is recorded.
- Never an external client, whatever their access to the workspace.
Owners and managers open the Privacy page. Those of them with identity access to the workspace change its rules; a manager without it sees the rules but cannot change them. Only owners give or remove identity access.
Pseudonyms cannot be reversed
A pseudonym is a keyed hash (HMAC-SHA-256) of the answer under the workspace's own key, which is never exported or shown. Someone without the key cannot turn a pseudonym back into the answer, or confirm a guess. The identity map (each pseudonym and the answer behind it) is made from the data on request, only for people with identity access, and every download of it is recorded.
Identifying datasets and case lists
A server dataset or a case list that names people can be marked Identifying data. Then only people with identity access download or preview it in the console, and every download, given or refused, is recorded. Phones still receive it with the forms that need it. See Server datasets and preloads.
Privacy is not encryption
Masking decides what people see. It does not encrypt the data on the server's disk; that is encryption at rest. And it does not change what a phone holds before it sends: an enumerator's phone has every answer they typed until the form is sent.