Skip to content

Security and trust

Your data, isolated and yours.

Security is not a checkbox at the end of the form. It lives in the database, at boot and on every request. This is the technical dossier, no smoke, for your team to audit before you sign.

Start freeTalk to sales
24+
RLS policies in the database
SHA-256
irreversible salted pseudonymization
16
durable rate-limit buckets

Isolated in the database

Row Level Security active, not just in the app

The ledger, line by line

We prove it line by line.

Before the details, the full ledger in a single view. Every row is a concrete guarantee your team can verify against the code.

B2B trust

Security by design

Your data lives isolated and yours. We prove it line by line.

Security is not a checkbox at the end of the form: it lives in the database, at boot, and on every request. This is the technical ledger, no smoke, for your team to audit.

  • RLSIn the database
  • GDPRGDPR-minded
  • EUResidency (roadmap)
Security ledger
  • IsolationMulti-tenant RLS, 24+ policies in the database, with an anti role-escalation clamp.
  • RespondentIP, user-agent and device stored only as salted SHA-256 hashes, irreversible.
  • PasswordsHashed with scrypt, constant-time compare, never returned to the client.
  • Public linksSigned with HMAC-SHA256, timing-safe, and invalidated on republish.
  • Access tokensStateless, with daily expiry, in an httpOnly cookie (not localStorage).
  • BootFails closed if the HMAC secret is missing or under 32 chars.
  • Free textRecursive HTML sanitization (anti-XSS) on every open field.
  • UploadsSVG sanitized (DOMPurify) and real type via magic bytes, not extension.
  • Rate limitingDurable across 16 buckets plus per-survey brute-force lockout.
  • TransportHSTS, strict headers, CSP with allowlist, CSRF/Origin verification.
  • Account12-char policy, re-auth and revoke-other-sessions on password change.
  • BillingStripe webhook with signature, tenant binding, idempotency and out-of-order protection.
  • AI safetyUntrusted data wrapped in defensive delimiters and fail-closed spend quotas.
  • Admin panelRead-only super_admin with a full audit log of privileged actions.
  • EU residencyData hosted in the European Union on the Enterprise plan.Roadmap

A single secret signs the tokens and salts the privacy hashes. If it is missing, the app does not boot.

GDPR-minded · server-only secrets · sanitized errors that never leak internal details.

The files

Five files, opened.

The ledger breaks down into five files by area: isolation, privacy, encryption and access, anti-abuse and the edges (account, billing and AI). Each one with its concrete clauses.

Each tenant, in its own cell.

Isolation is enforced in the database, not just in the app, so no query crosses the organization boundary even if the logic fails.

  • Row Level Security, 24+ policiesTwenty-four plus multi-tenant isolation policies live in the database. The boundary between organizations is enforced where the data is, not where the code is.
  • Anti role-escalation clampA clamp at the RLS level stops a role from escalating beyond its rank. No user can request more permissions than their role grants.
  • Parameterized queriesEvery query is parameterized: there is no SQL injection surface from string concatenation.

Truly anonymous, not marketing anonymous.

Anonymous responses keep no reversible traces of the respondent. Anything identifying becomes an irreversible hash before it touches disk.

  • Pseudonymized respondentIP, user-agent and device are stored only as salted SHA-256 hashes, irreversible. They cannot be undone to recover the original value.
  • Fail-safe if the salt is weakIf the secret that salts the hashes is weak, the system fails on the safe side instead of exposing data in the clear.
  • Server-only secretsThe service-role key and secret-reading modules are marked server-only and never reach the client bundle. Errors are sanitized and never leak internal details.

Signed, with expiry, in constant time.

Credentials are stored with algorithms slow by design, public links are signed and tokens expire on their own. Comparison is constant-time so timing leaks nothing.

  • scrypt passwordsSurvey passwords are hashed with scrypt and compared in constant time. They are never returned to the client.
  • Signed public linksPublic links are HMAC-SHA256 signed in a timing-safe way and invalidated when the survey is republished.
  • Stateless tokens, daily expiryAccess tokens are stateless and expire daily, in an httpOnly cookie (not localStorage).

Close the doors before they knock.

Sanitization, rate limiting and transport headers work together so hostile content and brute force never find a gap.

  • Recursive HTML sanitizationEvery free-text field is recursively HTML-sanitized (anti-XSS). SVG uploads are sanitized with DOMPurify and the real type is validated via magic bytes, not extension.
  • Durable rate limiting across 16 bucketsSixteen buckets cover signup, survey login, password verify, questionnaire fetch, uploads, exports, invites, admin reads and AI requests, plus a per-survey brute-force lockout.
  • Strict transportHSTS forces HTTPS, the CSP uses a per-request nonce with strict-dynamic (no unsafe-inline), dependencies are audited and hardened on every release cycle, and mutating requests verify CSRF and Origin.

Trust extends to every edge.

Account policy, the billing webhook and AI safety close the gaps that usually fall outside the classic perimeter.

  • Account policyUnified password policy (minimum 12 characters, high strength), re-authentication with the current password and revoke-other-sessions on change.
  • Verified billingThe Stripe webhook verifies the signature, binds the tenant (customer must match the org), enforces idempotency and protects against out-of-order events. The paywall is enforced in navigation and in the API.
  • AI safety and admin panelUntrusted data is wrapped in defensive delimiters and AI spend is reserved with per-user and per-org quotas that fail closed. The super_admin panel is read-only, with a full audit log of privileged actions.
  • Active sessionsSee which devices are signed in and close them remotely from Settings.

Boot

Fails closed, by design.

A single secret signs the tokens and salts the privacy hashes. If it is missing, or under 32 characters, the app does not boot. There is no insecure degraded mode.

  1. Load project HMAC secretpresent
  2. Validate minimum length (32 chars)ok
  3. Initialize token signingready
  4. Initialize privacy hash saltready
  5. If the secret is missing or short: boot halted

Better not to boot than to boot insecure.

GDPR built in

GDPR is not a checkbox. It is product.

Respondent rights, retention and consent do not live in a PDF: they are features with their own UI and verifiable proof. And the legal layer is public, in a Trust Center open to anyone.

Public Trust Center

/legal

EU data residency
  1. Privacy Policy
  2. Cookie Policy
  3. Data Processing Terms
  4. Subprocessors list
  5. AI Policy
  6. Acceptable Use Policy
  7. Security

Final legal texts, not drafts, published today in Spanish; translations will land with legal sign-off. The Trust Center chrome already follows all six app languages.

Visit the Trust Center

Provable consent

  • Terms acceptance with proofTerms acceptance is recorded at signup, with evidence of which version was accepted and when.
  • Immutable respondent recordsEvery respondent consent is stored as an immutable record: never edited, never overwritten, kept as evidence.
  • Configurable email checkboxAny survey can add an optional consent checkbox for using the respondent's email, with wording you define.

Rights center (DSAR)

Search, export or delete everything a respondent submitted, by their email and from Settings. GDPR articles 15, 17 and 20, always org-scoped.

Privacy by default, cookies included.

0
analytics cookies without consent: they only load if the visitor accepts
0
cookie banners on public survey pages
0
analytics scripts on public survey pages

Your respondents answer without being measured: the public survey page ships clean by design, no banner and no analytics of any kind.

The AI layer

AI, under the same rules.

Four short guarantees, no fine print.

  • Untrusted survey data is fenced against prompt injection at every AI entry point.
  • Every figure the AI cites is validated server-side against the real data before it is shown.
  • Per-org and per-user AI spend limits that fail closed, with a platform-level kill switch.
  • The AI engine is operated with an EU-friendly posture and listed in the public subprocessors document.

Everything about the AI layer

Compliance and roadmap

What you have now, and what is coming, labeled.

We draw a clear line between what is available today and what sits on the Enterprise roadmap. No fine print: anything that is roadmap is labeled roadmap.

  • Available todayGDPR-mindedGDPR mindset across the product: data minimization, respondent pseudonymization, server-only secrets and sanitized errors.
  • Available todayActive session managementList the organization's active sessions (device, IP, age, last activity) and close a specific one, always org-scoped.
  • Available todayPrivileged-action audit logFull audit log of super_admin panel actions and supervised cross-organization access.
  • Available todayConfigurable data retentionSet per-survey retention windows and let automatic purge delete expired responses, on every plan. GDPR data minimization in practice.
  • Available todayCompliance dossier for due diligenceInternal DPIA, record of processing activities (ROPA), breach procedure and vendor DPA checklist, ready for your Enterprise conversations.
  • Available todayEU data residencyData hosted in the European Union on the Enterprise plan.
  • RoadmapSingle sign-on (SSO)SSO for team access, on the Enterprise plan.
  • RoadmapCustomer-facing audit logsCustomer-facing audit logs of account activity, on Enterprise.

Roadmap items are not available today. If your purchase depends on one, write to us and we will give you a realistic timeline.

Audit it before you trust it. Then trust it.

Put the dossier in front of your own security team. For EU residency, SSO or a vendor questionnaire, talk to sales.

Try it freeTalk to sales

Create your free account and use every feature with your brand from minute one, no card to start. EU residency on Enterprise.