Organisations in healthcare, finance, HR and legal services often need to collect sensitive feedback while limiting access to the responses. Standard survey tools may leave administrators or service operators technically able to inspect all stored data.
The product
I created FellScan, a web application for building surveys and generating QR codes, with an optional end-to-end encryption mode for use cases that require stronger privacy.
The objective is a zero-knowledge design: encrypted responses stored by the service cannot be read without the user’s private key.
How encrypted surveys work
- The user creates a survey and enables end-to-end encryption.
- The application generates a public key and a private key.
- Respondents open the survey through a public link or QR code.
- Each response is encrypted before it is stored.
- The stored payload remains unreadable to the service operator.
- The owner decrypts the data locally with the private key.
Cryptographic architecture
FellScan uses hybrid encryption: AES-256 protects the response payload, while RSA-4096 protects the symmetric key. Private keys are generated and handled in the user’s browser and are not intentionally stored by the application.
- Private keys do not need to be sent to the server
- A database leak does not by itself reveal encrypted survey responses
- Losing the private key means losing access to the encrypted data
Possible use cases
- Healthcare: patient experience surveys containing sensitive comments
- Finance: confidential customer research
- HR: salary surveys, engagement research and manager evaluations
- Legal services: protected intake and client feedback
- Education: anonymous student feedback
Product features
- Unlimited survey creation and QR code generation
- Embeddable surveys
- Basic statistics and reporting
- Multiple interface languages
- Optional RSA-4096 and AES-256 encryption
- Data export and API integration options
My role
- Application architecture and database design
- Frontend and backend development in PHP and Laravel
- Hybrid-encryption and key-management design
- Protection against common web application threats
Encryption is only one part of compliance and must be assessed together with organisational controls, deployment and the applicable regulations. FellScan demonstrates how strong privacy mechanisms can remain simple for the end user.
If you need a secure survey or another custom application for a sensitive workflow, contact me.