Qualtrics FAQs
Frequently asked questions about the Qualtrics platform.
If you have been granted access to Qualtrics, please follow these instructions on the How Do I Log In to Qualtrics CX? page.
When clicking on the Qualtrics CX tile will automatically provision your account as a Standard User.
If you need access or are experiencing login issues, please submit a Qualtrics request through ServiceDesk Plus.
With the New Survey Taking Experience survey on by default, it meets the WCAG 2.1 AA accessibility standards for key features, the full list of which can be found in Overview of Improvements. Please refer to this article in the Federal Register for compliance dates for WCAG 2.1 AA.
Before publishing, an additional accessibility review will be conducted by the review team. This step will help confirm the presence of all ALT text and identify any other potential errors made by the content creator.
We strongly encourage all creators to utilize the built-in Issues & Tips Panel feature. This will help them to design optimal surveys and ensure compliance.
API or SFTP workflows in the FedRAMP High environment typically connect only to other FedRAMP environments. Qualtrics offers a robust API, but each case is subject to review by the DOM IT Governance team.
This page covers the main concepts for workflows and how to manage workflows after they’ve been built. See Building Workflows for instructions on how to build a workflow.
The DX Steering Committee, composed of members selected by IGOV to make decisions regarding the look and feel of the state of Iowa, convened to discuss branding and survey navigation. The committee's objective is to provide a trusted and safe experience for our constituents.
Theming
Each agency will have the state logo, followed by the agency name at the top of each form when in full screen and a portion of the website footer will be displayed.
Agencies having attached units that maintain their own sites for example, State Public Defender within DIAL, will have additional theme options available to identify those units.
If additional themes are needed, they must be approved by the Public Information Officer or a designated approver.
Display Name and Description
To ensure a positive browsing experience and to build constituent trust, a display and survey description are required for each published survey.
Survey Navigation
The labels "Back" and "Next" will be used to navigate through forms.
To learn more visit How Do I Brand and Theme a Survey? resource.
Given the environment is FedRAMP High , we are authorized to collect SSNs. Our Sensitive Data Policy masks SSNs by default; however if given prior authorization to collect this data, approved users can see collected SSNs or other sensitive information.
Qualtrics is FedRAMP High and all approved data centers are located in the continental USA.
There are three enclaves for Qualtrics CX, and all three are FedRAMP High and connected to Okta. The Base Enclave Brand is the default. Below is the classification for all three enclaves.
Enclave Classifications and Usage Guidelines
Base
- Usage: Default for most surveys - 80–90% of use cases
- Data Types: general confidential information
Moderate
- Usage: Provisioned only on a need basis - 10–20% of use cases
- Data Types: regulated data - by the feds or stricter agency policy, - SSA, Office of Child Support Services, Federal Parent Locator Service - FPLS and National Directory of New Hires - NDNH, HIV/AIDS, domestic abuse and child abuse death review team, maternal mortality, social security numbers maintained by Vital Records
High
- Usage: Provisioned only on a need basis - 10–20% of use cases.
- Data Types: HIPAA, FERPA, IRS FTI, Criminal Justice Information - CJI
If you believe any surveys may fall under Moderate or High categorizations, please reach out to the Qualtrics + Iowa Security & Quality Team or submit a ServiceDesk Plus Request.
The DOM DoIT Governance, Risk, and Compliance - GRC. Team provides guidance on regulated data. This process involves additional time and review to ensure compliance.
Users can upload multiple documents, but these must be separated into different survey questions; alternatively, the user can upload a ZIP file. The maximum file size for uploads is 50 MB.
Uploaded files from surveys are scanned for viruses during the upload process. This scanning occurs synchronously and utilizes ClamAV, an industry-standard antivirus tool that is regularly updated with the latest signature databases. If malware or a virus is detected in an uploaded file, the upload will be aborted, the file will not be stored, and an error message indicating the presence of the virus will be returned to the user and logged internally.
For more information about the File Upload question, please refer to this Qualtrics Support resource.
In Qualtrics, if certain data requires different retention periods, we can set various exemptions to meet business and security needs.
We received several highly sensitive questions regarding infrastructure and other back-end setup. This information should not be publicly displayed due to confidential cybersecurity information, as per Iowa Code § 22.7-50.
You can pass a session ID token from an external app to Qualtrics for the purpose of securing access to complete a form, primarily using the SSO Authenticator feature. Qualtrics supports various SSO authentication types including Token-based SSO, which allows a third-party to generate a secure token containing encrypted user information. This token is passed to Qualtrics, decrypted, and then used to authenticate the user before allowing access to the survey. The Token SSO authenticator can also be configured to capture identifying information such as embedded data within the survey results. Additionally, tokens can be configured with expiration and other security attributes to maintain session security. For detailed setup, you would use the Authenticator element within the Survey Flow and configure it as a Token type SSO with the necessary encryption parameters and keys provided by your external app to Qualtrics.
Qualtrics supports a Signature question type in the New Survey Experience, the default survey interface, allowing respondents to provide their signature by either typing or drawing, with the ability to switch between both input methods.
Depending on your use case, you may need to collect specific metadata to support authentication. We strongly recommend consulting your agency’s legal team to determine what constitutes a valid and authorized signature.
Qualtrics automatically collects metadata related to survey submissions. Below is a list of metadata that is collected by default.
- Start Date
- End Date
- Response Type
- IP Address
- Progress
- Finished
- Recorded Date
- Duration - in seconds
- Response ID
- Location Latitude
- Location Longitude
- User Language
Additional metadata can be enabled in Qualtrics to support compliance and auditing requirements. These settings must be configured during the survey design phase by adding the Meta Info question type.
This is a hidden question that automatically captures basic technical details about respondents, such as their operating system, browser, screen resolution, and more. It does not appear to respondents but is included in your survey data.
To learn more, please refer to the relevant Qualtrics Support page, and be sure you're viewing it in the context of the New Survey Experience, the default survey interface.
Additional compliance tip: You can include legal language in your survey to clarify that the signature provided represents the respondent’s consent or agreement. However, requirements may vary, so please consult your legal team to ensure the language and process meet your agency’s specific standards.