What Cipher checks

Cipher combines many small signals into one score. No single signal decides the outcome on its own: a response is flagged when several pieces of evidence point the same way, or when one piece is very strong.

This article describes the families of signals at the level you need to understand a flag. We don't publish exact rules or limits, because that would make Cipher easier to get around.

Which checks run depends on your survey's Cipher tier and your plan. See Cipher settings and plans.

Your survey sets the baseline

Cipher reads your survey before it judges a response. If a page tells people to open another site, try your product or look something up, leaving the page there is what you asked for, so it doesn't count against them. The same goes for a question that asks people to paste a link or a prompt. Pasted answers are still checked for AI-written text.

Cipher also learns from the people who have already answered. When most respondents leave the page or paste on the same question, Cipher treats that as normal for your survey.

If Cipher reads a question the wrong way, you can tell it what to expect. See Tell Cipher what a question expects.

Bots and automation

Cipher looks for signs that a browser is being driven by software: automation tools, browsers running without a screen, browsers that identify themselves in ways real ones don't, and devices whose reported details don't match how they behave.

Timing and speed

People need time to read. Cipher notices responses that finish far faster than the questions can be read, and timing that doesn't look like a person working through the survey.

Typing and paste behaviour

For written answers, Cipher looks at how the text got there: written in the survey, or brought in from somewhere else. It also notices typing and pointer movement that a person doesn't produce.

Attention and tab switching

Cipher notices when a respondent leaves the survey tab repeatedly or for long stretches, especially when it changes how an answer arrives. Stepping away once in a while is normal, and so is leaving on a question that sends people somewhere else. Browsers do not reveal which site or app someone switched to, so Cipher never sees that.

Straightlining and patterns

On grids and rating scales, Cipher notices when the same option is picked down a whole column, which leaves the answers with almost no information. It also looks for careless rating: long runs of the same answer, items answered far faster than the rest of your respondents answer them, and rating patterns that don't follow how everyone else answers the same items. These comparisons use your survey's own earlier responses, so they start once about 30 people have answered. Cipher also notices answers that are too short or too empty to be useful, and written answers that only repeat the question.

Contradictions and consistency

Cipher checks whether two answers in the same response can both be true. When Surbee generates a survey for you, it includes a few quality questions by default, which give Cipher something concrete to check:

• A hidden field. It is invisible to people, so an answer in it came from a script filling in the page. This flags the response on its own.
• An attention check. A question that tells the reader which option to pick. Picking a different one flags the response. With several checks, missing one of them counts for less than failing most of them. A check left unanswered is not graded.
• The same fact asked twice, far apart and worded differently.

These run on every plan.

Text quality and AI-written text

On Pro and above, Surbee's AI reads written answers and judges whether each one responds to the question and how much effort it shows. Cipher also looks for traces that chatbot output tends to leave in text, such as hidden characters.

Cipher weighs how an answer reads together with how it was entered, so a polished or formal writing style alone never flags anyone. When Cipher has no record of how an answer was entered, an AI-written reading is noted on the response but cannot flag it on its own.

Duplicate devices and networks

Cipher notices when several responses arrive from the same network in a short time, and these responses are flagged for you to review. On higher tiers it also looks for the same device submitting more than once, the same answers appearing on different responses, and groups of responses that arrive in lockstep. Higher tiers also check whether a connection comes through a VPN, proxy, Tor or a datacenter.

Mobile and touch signals

Phones and tablets don't produce mouse movements or the same typing patterns as a keyboard, so Cipher reads a different set of signals on touch devices, such as touch, swipes, the on-screen keyboard and how the device is held.

On every device, clicks and taps are judged against the size and position of what was pressed, so your survey's theme and layout never count against anyone. Big answer cards and small radio buttons are both read correctly. When a device doesn't share its motion sensors, Cipher judges the response on touch and content alone.

Invisible bot check

Surveys served from Surbee's own addresses run an invisible bot check in the background. Respondents don't see a puzzle or a checkbox. A response that fails the check is kept and flagged as Likely a bot, so you can decide what to do with it.