CandidSignal live demo: Acme Engineering Pulse survey

1 · Log in to the survey

The vendor is the only party that knows who you are. When you log in it issues a one-time eligibility voucher: a signed note saying “this person is allowed to respond,” with no way to tie it to the answer you’ll give.

Your employee name or id

2 · Your response

What just happened, cryptographically

Each line is a real step your browser and CandidSignal's trust services performed, not a simulation.

✓ Response recorded. Here is your proof

This receipt is your evidence that your answer was counted. It is bound to your answer by cryptography, and it is not linked to your name. Keep the token hash if you want to verify your response in the public log (step 4).

Token hash (your entry in the log)

Receipt signature

You’ve already responded

The system refused a second token for you. Notice how it refused. The vendor can’t see which stored answer is yours (there is no name on any answer), so it couldn’t have blocked you. The refusal came from the token issuer, which remembers it has already vouched for you once without ever learning what you answered. One person, one response, still anonymous.

3 · What the vendor sees

Every stored answer, exactly as the vendor holds it. There is no name, no user id, and no way to trace any row back to a person, including yours.

4 · Verify your own receipt in the log

CandidSignal publishes a tamper-evident transparency log and locates your entry by token hash. You don’t have to trust us: run the public audit CLI (below) against the published files and confirm your receipt is really in the signed log.