Security
How your data is kept
This page answers, in detail, what a procurement officer and a compliance officer ask: the path an answer takes, what we do to protect it, and what we commit to when something goes wrong.
The path of an answer, step by step
From the moment someone opens your link to the response landing in your dashboard — and what happens at each hop, not just what each hop is called.
1The respondent
Opens your link, or scans the QR code on your published survey.
- Encrypted connection (TLS)
- No account, no sign-in
2The survey page
They answer and press send, in their language and reading direction.
- Bot challenge
- Per-address rate limit
Processing & storageThe only place the answer is held.
3Validation
Every answer is checked against the survey's own schema before it is kept.
- Schema-validated input
- No respondent refused over your plan
4Storage
The answer is stored in full, pinned to the survey version it answered.
- Bound to your workspace alone
- Uploaded files in separate storage
5Your dashboard
It appears immediately, and only someone with permission reads it.
- Four roles, checked per action
- Export to CSV or Excel any time
Every hop on this path travels over an encrypted connection, without exception.
The measures in force today
Every line here is something the software does now, written with enough detail that you can ask a follow-up question about it.
Encryption in transit1
Nothing travels in the clear
Every request — the dashboard, the public survey, the API — is served over TLS, and a survey is never reachable without it.
Access control2
Permission is checked at the moment of the action
Four ordered roles per workspace — viewer, member, admin, owner. The role is read from the database when the action runs, never trusted from the session, so removing someone takes effect immediately.
Separation between customers3
Every record belongs to one workspace
Reads and writes on customer data go through a helper that applies the workspace filter first. A query that skips it fails the build rather than reaching production.
Audit trail4
Administrative actions are recorded
Who did what, and when, kept in an activity log the workspace can read. Security events are recorded separately, and no personal data is written to technical logs.
Abuse protection5
Submissions are challenged and rate-limited
Public surveys sit behind a bot challenge and per-address rate limits, and every input is validated against a schema before it is stored.
Getting your data out6
Your responses are yours to take
Export to CSV or Excel at any time, in either language. Deleting a response also deletes the contact entry it created; per-survey retention with automatic deletion is on the published roadmap.
Documents & commitments
What your legal team can read before signing, and what we are bound to after.
Data Processing Agreement
The sample DPA is published in full so procurement can review the terms before buying — and becomes a generated, signable document in the dashboard with the compliance release.
Read it in fullOur incident commitment
Any incident touching personal data is notified to affected workspace owners without undue delay, describing what happened, what was affected and what we did. Security events are recorded in an internal audit log, and no personal data is written to technical logs.
Backup & retention
The database is continuously backed up by its managed provider. Responses and contact details are kept as long as the related programme needs them, then removed; deleting a response deletes the contact entry it created. Per-survey retention policies with automatic deletion arrive with the compliance release.
Report something to us
If you have found a vulnerability, or received a survey that looks deceptive, there is one way in and it is short.
A vulnerability
Write to us with what you found and how to reproduce it. Please do not publish before we reply, and do not test against data that is not yours. Every report gets an answer.
Open the contact pageA survey that breaks the rules
A survey impersonating an organisation, or asking for card numbers or passwords, breaches the Acceptable Use Policy and is suspended on verification.
Acceptable Use PolicyNext:Try it before you ask about it.
Create a workspace and watch the measures above at work.