Why self-hosted survey tools for government consultations need a different build
A public body running a consultation has to collect feedback from residents, keep the responses under its own control and publish the results within a fixed window. For that job, the build is shaped less by survey features and more by three things: who owns the respondent data, whether the forms meet accessibility requirements, and how long responses must be kept. In the US, state and local government web content and mobile apps must meet WCAG 2.1 Level AA under the ADA Title II rule, with compliance dates of April 26, 2027 for entities serving 50,000 or more people and April 26, 2028 for smaller entities and special districts. Survey forms are web content, so they fall under those dates, and a contracted survey vendor's content does too. Confirm your own entity's population tier and whether your survey provider is covered by the contract language in your procurement documents.
For most consultations hosted in the body's own infrastructure, LimeSurvey Community Edition is the stronger starting point. It is free to download and self-host, stores survey data on the organization's server, supports multilingual surveys in more than 80 languages, and offers export plugins for statistical work. Formbricks suits short feedback forms and quick pulse questions, but its Community Edition is limited to one workspace, and SSO through OIDC or SAML, audit logs and team access roles require an Enterprise license. If audit logging and SSO for staff are non-negotiable, that cost and approval belongs in the first scoping conversation. No platform named here is certified for government use, so ask any vendor or partner for the evidence your own assessment requires.
Which rules set the build for a public consultation
This table maps each rule that can shape a government consultation survey to its source, what it means for hosting, encryption, SSO, retention and accessibility testing, and what to confirm with counsel. Read each row by first asking whether the rule applies to your agency, then checking the build consequence. Most of the build is set by accessibility and records duties, while federal and criminal justice rules apply only in specific scenarios.
| Rule or source | What it requires or signals | What it means for the build and what to confirm |
|---|---|---|
| ADA Title II, WCAG 2.1 Level A and AA | State and local government web content and mobile apps, including content provided through contracts or licenses, must meet WCAG 2.1 Level A and AA. Compliance dates are 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts (28 CFR 35.200). | Applies to every consultation form you publish. Test question types, error messages, multilingual pages and PDF downloads with assistive technology. Confirm with counsel which compliance date applies to your population and whether your vendor or hosting provider's contract covers accessibility commitments. |
| NIST SP 800-53 Rev. 5, moderate baseline | The moderate baseline in SP 800-53B selects 287 controls and enhancements. It is a federal control catalog, so it applies to federal-style work or where a contract or policy adopts it. | Use it as a reference set for hosting, access control, logging and encryption controls when a state or agency policy requires it. Confirm with your security office whether a moderate baseline is mandated or simply a good reference model. |
| 32 CFR 2002.14(h)(2) and NIST SP 800-171 | Federal agencies must use NIST SP 800-171 when setting requirements for controlled unclassified information on non-federal systems, unless the CUI category prescribes other safeguards. | Relevant if a consultation collects CUI, for example data tied to a federal grant or program, and the survey runs on a contractor or non-federal host. Confirm with the program office whether CUI is in scope and which safeguards its authority requires. |
| FedRAMP scope under OMB M-24-15 | FedRAMP covers cloud products and services that create, collect, process, store or maintain federal information for an agency. Systems used only for one agency's operations on cloud infrastructure, not offered as a shared service, are out of scope. | Self-hosting LimeSurvey or Formbricks inside your own cloud account generally keeps the tool under your agency's own authority. A SaaS or cloud edition hosted by a provider for several agencies may fall within FedRAMP scope. Confirm the status of any cloud provider with your federal or state contracting office. |
| NIS2 (Directive (EU) 2022/2555) | Covers central government entities regardless of size and lists public administration as a high-criticality sector. Member States may extend it to local public administration. It excludes entities working in national security, public security, defense or law enforcement. | For EU agencies, check whether your national transposition covers your body. If it does, expect duties on incident reporting, supply chain security and access control that reach the survey platform. Confirm the scope with your national authority or legal counsel. |
| FBI CJIS Security Policy v6.1 | Sets minimum requirements for criminal justice information. Version 6.1 took effect on 26 June 2026. It requires FIPS 140-3 validated modules or AES with 256-bit keys for CJI in transit and at rest outside physically secure locations, and vulnerability scanning at least monthly. | Applies only if criminal justice information enters the survey, for example case details in a police or court feedback form. If it applies, plan for encryption at 256-bit, monthly scanning and strict SSO and logging. Confirm with counsel and your CJIS Systems Agency whether any respondent data is CJI at all. |
| Records retention and public records law | Not a single federal rule. Consultation responses are often public records subject to state or local retention schedules and freedom-of-information requests. | Set retention and deletion settings per survey, export archives in open formats and document disposal. Confirm your retention schedule, whether submissions are published, and how personal data in comments is redacted before release. |
Which self-hosted survey tools fit a public body
Public consultations and citizen feedback call for different tools. Some need full question logic, multilingual forms and statistical exports, while others need short, targeted prompts inside a service. The cards below compare the open-source options and the hosting choice that sits behind them, with the checks a public body should make before it commits.
LimeSurvey for multi-question consultations
LimeSurvey is the default fit when a consultation needs long questionnaires, branching, and many languages. It supports more than 30 question types and multilingual surveys in more than 80 languages, and it is licensed under GPL v2.0 with the option to use any later GPL version. Its exports to R or Stata through the ExportR and ExportSTATAxml plugins suit analysts who publish results. Confirm the server stack against the current requirements: PHP 8.1.29 or later with mbstring and PDO, and a supported database such as PostgreSQL 14 or MariaDB 10.3.38 or later. Plan for the upgrade cycle, since the older 6.17.19 release is out of support.
Formbricks for short, targeted feedback
Formbricks suits brief feedback tied to a service, such as a single question after a permit application or a reaction to a public notice. Its core is licensed under AGPLv3, and the Community Edition includes unlimited surveys, responses and users, with Docker or Helm deployment. Access controls matter for a public body, so confirm early that OIDC and SAML single sign-on, teams with access roles and audit logs need the Enterprise license. Plan that license decision before go-live, not after the first consultation opens.
Enterprise license for SSO and audit logs
Single sign-on for civil servants and audit logs for reviewers are the two features most often needed in a government deployment, and both sit in Formbricks' Enterprise license rather than the Community Edition. The enterprise code ships in the Docker images and is unlocked with a license key, so the presence of the code does not mean the features are available. Ask the licensing question in writing, and confirm which features your access model depends on before choosing the edition.
Hosting region in a SaaS cloud edition
A SaaS cloud edition moves hosting outside your infrastructure, so the questions change from software fit to data location and provider control. LimeSurvey Cloud offers regions including Germany, Finland, the UK, the USA, Canada and Australia, and recommends Germany or Finland for EU customers. Formbricks Cloud lists a Frankfurt-hosted free tier. Confirm the exact hosting region, subprocessors, and what happens to responses when a subscription lapses. For many public bodies, self-hosting inside government infrastructure remains the simpler answer for personal data.
Accessibility of the chosen theme
Government web content must meet WCAG 2.1 Level AA under the ADA Title II rule, and the compliance dates are 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts. A survey tool's default theme does not carry that conformance forward into your customized design. Test the chosen theme yourself with keyboard navigation, screen readers and color contrast checks, and record the results. Do not treat a vendor statement as proof of conformance for your version.
What personal data a consultation collects and where it sits
A consultation rarely collects only answers to questions. The data categories a public body should map before launch are respondent names, email addresses and phone numbers, home postcodes, organization names for stakeholder responses, free-text comments, uploaded files such as letters or photographs, and the metadata the survey tool logs on its own, including IP addresses, user agents, timestamps and referrer pages. Free-text boxes are the hardest to control. A resident may describe a medical condition, a family situation or a complaint about a named neighbor, so the reader should treat every open field as a possible location for special category data. Ask the survey platform's administrators which request logs are written, where they are stored, and how long they persist, because a web server log can hold IP addresses even when the questionnaire itself asks for nothing identifying.
Anonymous and identified submissions need separate handling from the first design decision. An anonymous response should not store a name, email, postcode or IP address in the response table, and the link or invitation process should not be able to match a response back to a person. An identified response, such as a formal submission from a named organization or a resident who asks for a reply, needs its own retention rule and a clear statement on the consultation page about what will be published. Publication is where re-identification risk concentrates. A table of results broken down by a small local area, a single ward, a rural postcode district or a small employer group can reveal who answered, especially when combined with a distinctive comment. Before publishing, the team should set minimum cell sizes for any breakdown, suppress or group small categories, review quoted comments for names and health details, and have a second person check the output.
Deletion is governed by the records retention schedule the public body has adopted, not by the survey tool's default settings. Confirm with the records officer which schedule applies to consultation responses, consultation correspondence and access logs, how long each record must be kept after the consultation closes, and whether the schedule requires preservation of the published report and the raw responses separately. Then check whether the platform can delete responses, uploads and logs on that timetable, and whether backups are included in the deletion process. The records officer also decides the status of anonymized data, which may be retained longer than identified data. Record these decisions in writing before the first live consultation, since they determine the configuration of the survey, the backup policy and the data protection impact assessment.
Hosting choices by level of government
Federal agencies in the United States work under FISMA and the control catalog in NIST SP 800-53 Rev. 5, where the low, moderate and high baselines select 149, 287 and 370 controls and enhancements respectively. The FedRAMP scope rule matters most when a survey is delivered as a cloud product: FedRAMP covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency, while systems used only for a single agency's operations on cloud infrastructure and not offered as a shared service fall outside it.
- Self-hosted in agency infrastructure: Running LimeSurvey or Formbricks on agency-controlled servers keeps the survey service within the agency's own authorization boundary, which is typically the simplest path to evidence.
- Cloud-hosted editions: A SaaS or managed edition used by an agency to collect federal information may bring FedRAMP into scope, so confirm whether the provider holds the relevant authorization.
- Controlled unclassified information: Agencies set safeguards for CUI on non-federal systems using NIST SP 800-171 under 32 CFR 2002.14(h)(2), unless the CUI category prescribes other safeguards.
- Accessibility deadlines: The ADA Title II rule applies to state and local government, not directly to federal agencies, so federal teams should follow the Section 508 requirements that govern their own sites.
- Authority to operate: Ask the agency's authorizing official which baseline and boundary apply before selecting a hosting model.
Confirm the authorization status of any cloud edition and the baseline your system is assessed against before you commit to a hosting model.
State and regional bodies sit between federal rules and local practice. Their survey tools often hold data that falls under state records law and, where criminal justice information is involved, under the FBI CJIS Security Policy. Version 6.1 of that policy took effect on 26 June 2026 and requires FIPS 140-3 certified modules or FIPS 197 AES with at least 256-bit keys for CJI in transit and at rest outside physically secure locations, along with vulnerability scanning at least monthly.
- Web accessibility: State and regional government web content and mobile apps must meet WCAG 2.1 Level A and AA. The compliance date is 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts, under 28 CFR 35.200.
- Contracted content: The ADA rule also covers web content provided through contracts or licenses, so a survey vendor's hosted form can fall within the obligation.
- Criminal justice surveys: Feedback from police or court users may touch CJI, which moves the hosting and encryption requirements to the CJIS level.
- Records retention: State retention schedules define how long consultation responses must be kept, which sets backup and deletion requirements.
- Federal funding: Federal grant or program terms can add NIST SP 800-171 or other control requirements to a state system.
Ask your state CIO office and legal counsel which records schedule, CJIS scope and ADA population category apply to your entity.
Municipalities and special districts are often the smallest operators of consultation tools, and the ADA deadline for them is 26 April 2028 if they serve fewer than 50,000 people. That later date does not reduce the need to build accessible forms, since the same WCAG 2.1 Level AA requirement applies once the deadline arrives. Many municipalities host survey tools on their own virtual machines or on a provider's cloud account, which is a different situation from using a SaaS edition run for an agency.
- Own virtual machines: A municipality that runs LimeSurvey or Formbricks on its own virtual machines controls the boundary directly, so FedRAMP scope is not triggered by its own operations.
- Shared provider services: If a regional hosting provider runs the survey service as a shared offering for several public bodies, the provider's cloud obligations may matter, so ask the provider how the service is scoped.
- Population count: Confirm the population figure your entity uses for the ADA category, because the 50,000 threshold decides the deadline.
- Special districts: Districts such as water or transit authorities follow the 2028 date unless their population crosses the threshold.
- Staffing: Smaller teams often depend on a partner for patching, backups and accessibility testing, so write these duties into the scope.
Confirm your population category, the hosting boundary and who patches the server before the first consultation opens.
In the European Union, NIS2 treats central government entities as in scope regardless of size and lists public administration as a sector of high criticality. Member States may extend the directive to local public administration, so a municipality's obligations depend on its national transposition. NIS2 does not apply to entities working in national security, public security, defense or law enforcement, and those bodies are governed by separate rules.
- Central government: Ministries and central agencies fall within NIS2 coverage regardless of size, so their survey platforms belong in the risk management and incident reporting scope.
- Local administration: Municipalities are covered only where the Member State has extended the directive, so check the national law.
- Exclusions: Consultations run by security, defense or policing bodies are generally outside NIS2, but confirm the boundary with the national authority.
- Interoperability: Regulation (EU) 2024/903, the Interoperable Europe Act, supports reuse of common approaches across public bodies, which can inform how forms and data exchange are designed.
- Accessibility and data: EU bodies must also meet national accessibility and data protection duties, which apply alongside NIS2.
Confirm with your national competent authority whether NIS2 applies to your level of government and which exclusions apply to your mandate.
How a consultation platform goes live in phases
A government consultation platform moves from written scope and legal basis to a tested, published and handed-over service in a fixed sequence, so each phase produces evidence the next one depends on.
Confirm scope and legal basis in writing
The agency or municipality, with its legal and records teams, defines which consultations the platform will host, which respondent data it collects, which languages and accessibility obligations apply, and which governing rules set retention. DeployOpen drafts the scope document and the partner confirms it in writing before any build work starts. The step closes when the signed scope lists deliverables, exclusions, responsibilities and the applicable accessibility and records requirements, and each open question has a named owner. Ask the partner to state in the quote how phase durations follow from this written scope, since timelines depend on it.
Select platform and edition against requirements
The team scores LimeSurvey, Formbricks or another option against the written requirements table, covering hosting location, identity integration, question types, multilingual support, export formats and the features each edition includes. Where a feature such as SSO or audit logging sits behind a paid license, the decision records that cost and who is responsible for it. The step closes with a documented platform and edition choice, signed by the business owner and the security lead, along with the open items that could change it. Confirm any capability you rely on directly with the vendor before committing.
Build hosting and identity inside the boundary
The partner deploys the platform into the agency's own cloud account, data center or government network, configures the database, storage, backups and encryption, and connects staff sign-in to the organization's identity provider. Administrative roles are defined so that only named staff can build surveys, view responses or export data. The step closes with a deployment record showing where every component runs, how keys are managed, which accounts have access, and that test responses stay inside the boundary. Where the agency needs a cloud service assessment, confirm early whether the chosen hosting model falls within that assessment's scope.
Test accessibility and multilingual delivery
Testers check every public-facing form and results page against WCAG 2.1 Level AA, including keyboard navigation, screen reader labels, color contrast, error messages and timeout behavior. Each supported language is tested for correct character rendering, right-to-left handling where required, translated logic and export. Findings are logged with severity, fixed, and retested by someone other than the developer. The step closes with a test report listing each defect, its fix, and the remaining known issues with an agreed plan. The ADA Title II rule sets the compliance dates for state and local government web content, so confirm which date applies to the agency.
Configure data protection and retention rules
The team sets the retention periods for responses, personal data, audit logs and backups in line with the agency's records schedule, configures anonymized or pseudonymized collection where consultations allow it, and locks down export, deletion and access logging. Privacy notices and consent text are reviewed by the agency's legal and data protection staff. The step closes with a configuration record mapping each data category to its retention rule, its storage location and its deletion method, which the agency can use when answering records or access requests.
Run a pilot consultation with internal testers
Staff who were not involved in the build complete a realistic pilot consultation from start to finish, using the languages, question types and access routes the public will use. Testers submit responses, attempt to break logic and permissions, export results, and check that published summaries match the raw data. The pilot runs in the production environment with a clearly marked test consultation. The step closes with a pilot log of issues, their resolution and sign-off from the consultation owner, confirming that the team can run the process without the implementation partner present.
Go live with a publishing procedure
The agency approves a written publishing procedure covering who creates and launches a consultation, who reviews the text and translations, how closing dates are set and communicated, and how results and responses are published. The partner supports the first live consultation and watches monitoring and error alerts closely. The step closes when the procedure is signed, the first consultation is live, and the monitoring and backup checks are confirmed working.
Hand over operations and support terms
The partner delivers runbooks for administration, backup and restore, upgrades, access reviews and incident response, and trains named agency staff to use them. Support terms, including whether ongoing maintenance, upgrades and retesting are covered by a retainer, are agreed in writing. The step closes with a signed handover record listing the owners of each runbook, the support contacts and the scope of work that ends at handover, so the agency knows exactly what it operates from that point.
Which evidence a records or accessibility review asks for
This table lists the artifacts a records officer, inspector general, data protection officer or accessibility auditor typically requests for a consultation survey system, and the component that produces each one. Read each row as a question to answer before go-live, and note that DeployOpen prepares the evidence while independent auditors or certification bodies issue any attestation.
| Evidence artifact | Produced by | What the reviewer checks |
|---|---|---|
| System security plan mapped to the chosen baseline | DeployOpen documentation, mapped to the agency's chosen NIST SP 800-53 baseline | Which controls apply, who owns each one, and where the agency's own controls inherit from the hosting layer |
| Accessibility conformance report per consultation template | Accessibility testing of each published template, run against WCAG 2.1 Level AA | Each questionnaire, language version and results page, with issues logged and fixed before publication |
| Data flow and hosting location record | Architecture documentation for the LimeSurvey or Formbricks deployment and its integrations | Where responses are stored, which services receive them, and whether any third-party tool moves data out of the jurisdiction |
| Retention and deletion schedule with configuration screenshots | Agency records schedule, with platform settings and deletion jobs configured in LimeSurvey or Formbricks | That the schedule in policy matches what the platform actually deletes, including backups and exports |
| Access review logs and audit logs | Formbricks Enterprise license for audit logs and access roles; LimeSurvey admin and activity logs as configured | Who created, edited, exported or published each survey, and whether access was reviewed on a fixed cycle |
| Encryption configuration | TLS settings at the reverse proxy, database encryption and key management in the agency's infrastructure | That data in transit and at rest is encrypted with approved algorithms and key lengths, and that keys are held under agency control |
| Vulnerability scan results | Scanning tools run by the agency or DeployOpen against the platform and its hosts | Scan frequency, severity handling, and evidence that findings were fixed or formally accepted |
| Publication record of results | Survey platform export logs and the agency's publication workflow | What was published, when, in which languages, and that no respondent data was exposed in published results |
What to ask an implementation partner before signing
Ask the partner to answer these questions in writing and to name one responsible person for each answer. First, ask how each template and each language version is tested against WCAG 2.1 Level AA, including the keyboard path, screen reader labels and error messages, and which tool and manual checks produce the record. Ask how the same test covers translated questionnaires, since a form that passes in English can fail once translated labels change reading order. Ask for the test log for every template before signing, not a general accessibility statement. Also confirm the platform edition: the LimeSurvey Community Edition 7.6.0 is the current stable release, and the partner should state which version it will deploy and how it will handle patches for the 7.x line.
Ask how civil servant accounts will sign in. Confirm whether the partner will connect the survey platform to your identity provider through SSO, how roles separate survey designers, translators and publishers, and whether audit logs record administrative changes and exports with user and time. Ask where the platform will run, which network boundary separates it from the public internet, and whether any component, such as an email relay, a translation service or a hosted analytics script, sends responses or metadata outside that boundary. Request a data flow diagram that a data protection officer or inspector general can read, listing each system, each transfer and each location where respondent data is stored.
Ask how the fixed scope covers translation handling, publication of the consultation summary, and the retention and deletion steps at close. Confirm who is responsible for translation quality, whether the partner or your team approves each language, and what is included in publishing results in an accessible format. At the end of the consultation, ask what happens to responses: how they are exported, when the live instance is locked, how a retention period is applied, and how deletion is verified and recorded. Finally, ask who signs off on the evidence pack, which items it contains, and what it does not claim, because an independent auditor or your own assessor must still make the determination.
What do buyers ask before hiring help for government survey hosting?
How much effort does a government survey build take, and what drives it up?
Effort depends mostly on scope, not on the tool. The main drivers are the number of languages each questionnaire needs, how deep accessibility testing goes, whether the survey must sit behind your identity provider through SSO, and whether responses from an earlier consultation or a legacy tool must be migrated. Each driver adds design, configuration and test work. Ask the partner to split the estimate by driver so you can see which choices move the timeline and budget. No duration is set here because it depends on the written scope and your environment.
Can our public body run a self-hosted survey platform with internal staff?
Often yes for routine use, but the first build and the hardening work usually need specialist skills. Your team needs people who can administer a PHP and database stack, manage backups and patches, configure SSO and keep logs and access records. LimeSurvey Community Edition is free to download and self-host, so the software itself carries no licence fee, but staff time, hosting and upgrades remain yours to pay for. Confirm internal capacity for the upgrade cycle, since LimeSurvey 6.17.19 reached end of support on August 31, 2026 and older versions must be moved off.
What does our agency need to provide before implementation starts?
Four inputs usually determine how quickly work can proceed:
- Legal basis sign-off from the team responsible for the consultation, including what personal data the questions collect.
- A records schedule that states how long responses and personal data are kept and how they are disposed of.
- Read access or a configuration handover for your identity provider, so SSO for administrators or respondents can be tested.
- Test accounts and a staging environment where the team can review accessibility and multilingual text before publication.
Agree who signs each input in the written scope so delays are visible.
How does the cost split between one-time setup and recurring hosting?
Setup is one-time: scoping, installation, configuration, migration, accessibility and security testing, and documentation for the records and compliance file. Recurring costs include your own infrastructure, backups, monitoring, staff time, security patches and version upgrades, and any support retainer. Software licences are not the main variable with self-hosted open source, but a managed cloud edition is a recurring subscription with its own limits. Ask for the quote to list each item separately, including which items repeat annually and what triggers a change order.
Is Formbricks or LimeSurvey cheaper to run for consultations?
It depends on the job. Formbricks Cloud, as published in October 2026, lists a Hobby plan free with 250 responses per month hosted in Frankfurt, Pro at $74 per month with 2,000 responses and Scale at $325 per month with 5,000 responses. Those plans are aimed at in-product and web feedback, and a consultation with long questionnaires, file uploads and multilingual text may need more than the lower tiers. LimeSurvey Cloud is priced by response volume and admin count, with Corporate by quote. Self-hosting either tool avoids those subscriptions, but you then carry infrastructure and staff costs. Compare total cost over the consultation schedule, not the monthly list price.
What changes the timeline once a fixed scope is agreed?
Changes after signature usually come from late decisions and outside dependencies. Common triggers are new languages added after translation has begun, a switch in identity provider, a records rule that is confirmed late, or accessibility findings that need a redesign of question layouts. Each change should go through a written change request that states the effect on deliverables, dates and cost before work resumes. Ask the partner how the change process works and which dependencies, such as your identity team or legal review, sit on the critical path.
How DeployOpen scopes a government survey deployment
DeployOpen plans, implements, hardens and documents self-hosted survey platforms inside your own cloud accounts, data centers or air-gapped networks, so consultation responses stay under your control. Engagements are fixed-scope, with the scope, deliverables and timelines agreed in writing before any work begins.
How we scope
- Written scope names the platform, edition, hosting location and the consultation types it must support.
- Scope lists accessibility checks, language versions and the WCAG 2.1 AA evidence your forms must produce.
- Scope defines records retention periods, publishing steps and the integrations your agency needs to connect.
How we build
- We install and configure the chosen platform in your infrastructure with multilingual questionnaires and accessible templates.
- We set up single sign-on, access roles and encryption settings agreed during scoping, with logs kept for review.
- We run security testing and accessibility checks on forms before any public consultation goes live.
How we hand over
- You receive configuration, architecture and runbook documentation covering hosting, backups and access controls.
- Compliance evidence is prepared for your assessors, but independent auditors and certification bodies issue any formal findings.
- Staff training covers building consultations, exporting results and applying the retention rules set in scope.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after go-live.
- Patches and version upgrades are planned around active consultation windows so public forms stay available.
- Ask any partner to confirm response times, upgrade terms and who holds administrative access after handover.
