A public anonymous URL is not an employee Q&A
Authenticated anonymous questions from employees fail when “anonymous” means a public link anyone can spam. The projector becomes a troll board. The CEO spends the hour on HR. The next town hall goes back to named mics and silence. Honesty dies on both ends.
| Setup | Who can submit | What the room sees |
|---|---|---|
| Open public form | Anyone with the URL, including people not in the meeting | A firehose, including abuse from outside the session |
| Named mic or named chat | Only people willing to attach a career to the sentence | Polite questions and a quiet back row |
| Session-gated anonymous | People who joined this live session; names off | No names on questions, only questions from the room |
Session-gated is the mechanic we actually ship. Attendees join with a PIN or QR. “Ask for a name” is off by default, so they skip the name field and questions show no names. That is not SSO against the HR directory. Do not brief legal as if it were. It is still a gate: you had to be in the session. A pastebin in Slack is not a gate.
Some rooms need more than a PIN. Login only is the stricter gate, and it is an Enterprise feature. It works on presentations: attendees are verified by an email code before they join, so run the Q&A as a slide in that presentation. On every other plan, the session PIN is the gate.
Google’s research on psychological safety is about whether people can take a risk. Anonymous display is that risk. Gallup’s workplace research ties engagement to a chance to contribute. A public troll board trains the opposite: the loudest outsider owns the wall.
Survey tools such as Microsoft Forms draw a useful split. Org-only plus “record name” off is a different product than a public link. People still ask how they can know it is anonymous. Your job is to say what the room will see, before the first submit.
What we tell the room before anyone types
Say the rule in one breath. “You join with today’s code. Names are off. The wall shows questions, not people. Abuse and private HR items will not be read. Hard business questions will.” If you skip the sentence, every later skip looks political.
Use anonymous live Q&A in the poll workspace. Keep the join on phones. We live-host. We do not embed a board in a slide the AV laptop cannot pause.
Names off is not a promise of forensic invisibility
Be precise. Display anonymity means the projector and the default host view are not a roll call. It does not mean a novel writing style can never be guessed in a 12-person team. It does not mean you should advertise “the company cannot ever tell.” If your counsel needs true untraceability, that is a third-party survey with a contract, not a live town hall board.
For a 200-person all-hands, session join plus names off is the practical pair. Outsiders without the PIN are not in the lobby. Employees in the lobby are not wearing name tags on the LED wall. That is enough to stop the classic troll pattern: a public URL posted on social, filled by people who are not in the meeting.
RiLiFi’s free tier allows 100 participants per session, so a mid-size town hall is not cut off by an arbitrary paywall while you test this format. Larger rooms need a plan that matches your licensed cap. Pro covers 1,000, and Enterprise covers 5,000+.
How trolls actually get in
They get in when the URL is public on the website, or when a live session’s PIN shows up on a public recording. They also get in when you leave named chat and anonymous Q&A unlabeled on the same wall. The room then blames the person in row three for a line that came from a phone.
Every live session gets a new PIN, so April’s code dies with April’s session. Do not put the join on an unauthenticated marketing page. Put it on the lobby slide and in the meeting chat once the session is live.
If someone is in the session and still posts abuse, that is a conduct problem, not a URL problem. Remove the item. Apply the workplace rule you already have. The board should not be the only enforcement.
A pending list that never hits the wall is a different job. Here the job is membership: only the session, names off.
After the hour, close the lobby
End the session. A board left live after the hour is how trolls arrive. (A session also ends on its own after 3 hours with no activity.) Export what leadership promised to answer (downloads are on Creator and above). Send the themes. If you ghost the hard questions, people will test the next board with worse faith.
Keep a shared folder for the Q&A asset so a backup host can open the Q&A and start it again if the primary laptop dies. View access by email is enough to host, and they can moderate the session they start. Do not email a public link around “so the intern can help.” The intern should join as a host account, not as a forwarded URL.
Hybrid rooms need the same gate. Remote staff join with the PIN posted in the meeting chat once the session is live, not from a tweeted screenshot. If you stream the town hall publicly, do not superimpose a working join code on the YouTube overlay. That overlay is a public URL with extra steps. Put an “employees use the PIN in the meeting chat” line on the stream instead.
Authenticated anonymous questions are a session plus hidden names. They are not a public pastebin. On Enterprise, Login only adds an email check on top. Gate the join. Say what the wall will show. Then let the hard questions through.
Small companies still get trolled, just by fewer people. A 40-person all-hands with a public Google Form will collect jokes from someone’s roommate. The PIN still matters. Named chat still silences the intern. Use the session gate anyway. The archive from a 40-person room is easier to read. It is not easier to recover if the first line on the wall is abuse.
Do not add a spinning wheel to this hour. The wheel is a giveaway tool. This is a trust event. Keep the board boring and the questions sharp.