LimeSurvey for University Research: GDPR-Compliant Surveys, Ethics Approval, and Surviving a 40,000-Invite Launch Day on PaaS

Academic research runs on surveys, and research ethics boards have become specific about where survey responses live and who can reach them. Commercial survey platforms answer with a data processing agreement and a region list; a self-hosted platform answers with a named environment. This post follows a university research office running LimeSurvey on MassiveGRID PaaS, which is built on Virtuozzo Application Platform, formerly Jelastic, through an ethics application and a large launch.

The institution is a university we will call Harcourt University, whose research office supports about 300 surveys a year for faculty, including an annual student-experience study sent to 40,000 students on one morning. The LimeSurvey package installs the Community Edition on a PHP application server with the upload limits and extensions it needs, plus a MariaDB database.

What the ethics board asked, and what the office answered

Harcourt's research ethics committee has a standard set of hosting questions for any study collecting personal data. Where is the data stored? Who at the provider can access it? How is it encrypted in transit and at rest? How long is it kept and how is it deleted? Can participants withdraw and have their responses removed? The office's answers for the LimeSurvey environment:

• Location: the London region, a named data centre operated under a GDPR data processing agreement by an ISO 9001-certified provider. Backups are in the same region.
• Access: platform access through collaboration roles, with the research office as administrators, individual researchers as LimeSurvey users with rights only to their own surveys, and the data protection office with read-only platform access.
• Encryption: HTTPS via the Let's Encrypt add-on for every respondent; LimeSurvey's own encrypted attributes for named fields; the platform's storage on encrypted volumes per the provider's documentation.
• Retention and deletion: LimeSurvey's per-survey response purge, plus the office's policy that survey data is exported to the researcher's secure store and deleted from LimeSurvey within a set period after close.
• Withdrawal: token-based surveys link a response to an invitation token, so a participant's response can be found and deleted on request without the response being otherwise identifiable.

The committee accepted the answers as a standing hosting description, so individual studies now reference it rather than repeating it.

Why not a commercial survey platform

The university had a commercial platform, licensed per user with a cap on responses per year. Two things pushed the office to self-host. The response cap collided with the student study every spring, and the platform's per-user licensing meant only a handful of researchers had accounts, so the office ran surveys on their behalf. LimeSurvey's Community Edition has no licence and no response cap, so every researcher gets an account and the office becomes a support function rather than a bottleneck. The comparison was less about money than about who gets to use the tool.

Launch day: 40,000 invitations at 09:00

The student-experience survey is sent by LimeSurvey's token system: each student receives a personalised link, and LimeSurvey tracks who has responded for reminders. Sending 40,000 emails through the university's SMTP relay is done in batches by LimeSurvey's own batch sender, run from the platform's cron so it does not depend on a browser window. Respondents arrive within minutes of the email landing, and the first hour sees several thousand concurrent respondents on a normal Tuesday morning.

The research office's technical lead handles this with vertical scaling. LimeSurvey is a PHP application whose load is mostly PHP-FPM workers and database writes as answers are saved; the PHP node's cloudlet limit is raised from its everyday 16 to 48 the week before launch (a cloudlet is 128 MiB of RAM plus 400 MHz of CPU), and MariaDB's from 12 to 32. On the day, the platform allocates cloudlets to both containers as respondents arrive and releases them as the wave passes; billing follows the hour's actual use. The office's rehearsal is a clone of the environment loaded with a copy of last year's survey and hit by a load-testing tool at 2,000 concurrent respondents, which is how the lead learned that LimeSurvey's default session handling wanted Redis for that scale, and added a Redis node.

Exports the researchers actually use

LimeSurvey exports to SPSS, R, Stata, CSV and Excel with variable labels intact, which is what makes it useful to a statistics department and is where the office spends its support time. Exports are downloaded over HTTPS by the researcher who owns the survey, moved to the university's research data store, and then the survey's responses are purged from LimeSurvey per the retention policy. The Database Backup/Restore add-on keeps nightly dumps for 14 days as protection against accidental deletion, a retention the ethics committee agreed as short enough.

Cost, and the office's point

Outside launch weeks the environment averages about 14 cloudlets an hour across the PHP, MariaDB and Redis nodes, roughly $34 a month before discounts at MassiveGRID's published $0.003372 per cloudlet-hour. The two launch weeks each year add a few tens of dollars. The commercial platform's annual licence had been a five-figure sum with a response cap. But the office's point to the faculty was not the saving; it was that 300 surveys a year now belong to the researchers who run them, on a platform whose location and access the ethics committee has already approved.

Frequently Asked Questions

Is LimeSurvey Community Edition really unlimited?

Yes. The Community Edition is GPL-licensed with no cap on surveys, responses or users; you pay for the hosting environment's resource use. LimeSurvey GmbH's hosted service and its Professional plugins are the paid options, and are not required for what is described here.

Can LimeSurvey use the university's single sign-on?

Yes. LimeSurvey has authentication plugins for LDAP and for SAML-based single sign-on, so researchers log in with university credentials and accounts can be provisioned automatically on first login.

How do we make a survey anonymous yet still send reminders?

Use LimeSurvey's anonymised-responses option with tokens: the token table tracks who has responded for reminders, while responses are stored without the token link and with timestamps rounded, so a response cannot be traced to a participant. This is the standard pattern ethics boards ask for.