How this is built, and what I would build for you

-- ─── identity ────────────────────────────────────────────────────────────────

create table companies (
  id            text primary key,              -- stable slug, used in exports
  name          text not null,
  country       text not null,
  tier          text not null check (tier in ('brand','tier1','tier2')),
  joined_cycle  int  not null
);

create table cycles (
  year    int primary key,
  status  text not null check (status in ('draft','open','closed')),
  opens   date not null,
  closes  date not null
);

-- ─── the questionnaire ───────────────────────────────────────────────────────

-- One row per question, ever. The id is chosen once and never changes.
-- Everything that a respondent sees lives in question_versions instead.
create table questions (
  id             text primary key,             -- e.g. 'ENR.COAL.PHASEOUT'
  section        text not null references sections(id),
  introduced_in  int  not null references cycles(year),
  retired_in     int  references cycles(year)  -- null while still asked
);

-- One row per (question, cycle). Inserting here is how the form changes.
-- Nothing in this table is ever updated after its cycle closes.
create table question_versions (
  question_id  text not null references questions(id),
  cycle_year   int  not null references cycles(year),
  prompt       text not null,
  answer_type  text not null check (answer_type in
                 ('boolean','select','multiselect','number','percent',
                  'currency','year','text','longtext')),
  options      jsonb,                          -- ordered, for select types
  unit         text,
  help         text,
  required     boolean not null default true,
  position     int not null,
  -- Conditional logic, versioned with the question: {"tiers": [...]} or
  -- {"qid": "...", "equals": [...]}. Who sees a question can change between
  -- cycles without touching a single stored answer.
  show_if      jsonb,
  primary key (question_id, cycle_year)
);

-- Transformations a question_id match cannot express: a split, a merge, or a
-- wholesale replacement. Dated to the cycle the change takes effect in.
create table question_lineage (
  id           bigserial primary key,
  cycle_year   int  not null references cycles(year),
  kind         text not null check (kind in ('split','merge','replace')),
  from_ids     text[] not null,
  to_ids       text[] not null,
  note         text not null
);

-- ─── the answers ─────────────────────────────────────────────────────────────

-- The only table that matters in five years. Keyed on the permanent question
-- id, never on wording or position, which is what makes a rewrite survivable.
create table responses (
  company_id   text not null references companies(id),
  cycle_year   int  not null references cycles(year),
  question_id  text not null references questions(id),
  value        jsonb,
  status       text not null default 'answered'
                 check (status in ('answered','carried','confirmed','blank')),
  updated_at   timestamptz not null default now(),
  updated_by   uuid references auth.users(id),
  primary key (company_id, cycle_year, question_id)
);

create index responses_by_question on responses (question_id, cycle_year);

create table submissions (
  company_id    text not null references companies(id),
  cycle_year    int  not null references cycles(year),
  state         text not null default 'not_started'
                  check (state in ('not_started','in_progress','submitted')),
  submitted_at  timestamptz,
  submitted_by  uuid references auth.users(id),
  primary key (company_id, cycle_year)
);

-- Append-only. Answers change; the record of who changed them does not.
create table response_audit (
  id           bigserial primary key,
  company_id   text not null,
  cycle_year   int  not null,
  question_id  text not null,
  old_value    jsonb,
  new_value    jsonb,
  changed_by   uuid,
  changed_at   timestamptz not null default now()
);

-- ─── who can see what ────────────────────────────────────────────────────────

create table memberships (
  user_id     uuid not null references auth.users(id),
  company_id  text not null references companies(id),
  role        text not null check (role in ('respondent','approver')),
  primary key (user_id, company_id)
);

alter table responses  enable row level security;
alter table submissions enable row level security;

-- A member sees exactly one company's answers. Enforced by the database, not
-- by the application — so an export script or a stray query cannot leak.
create policy member_reads_own on responses for select
  using (company_id in (select company_id from memberships
                        where user_id = auth.uid()));

-- ...and can only write while their cycle is open.
create policy member_writes_open_cycle on responses for insert
  with check (
    company_id in (select company_id from memberships where user_id = auth.uid())
    and cycle_year in (select year from cycles where status = 'open')
  );

create policy member_updates_open_cycle on responses for update
  using (
    company_id in (select company_id from memberships where user_id = auth.uid())
    and cycle_year in (select year from cycles where status = 'open')
    and not exists (select 1 from submissions s
                    where s.company_id = responses.company_id
                      and s.cycle_year = responses.cycle_year
                      and s.state = 'submitted')
  );

-- Programme staff read everything; they are a separate role, not a company.
create policy staff_reads_all on responses for select
  using (auth.jwt() ->> 'role' = 'programme_staff');

The point of the low-cost column in your brief is served better by owning a small application than by renting a per-seat platform: your cost does not move when the membership grows from 58 to 120.