Your data is the foundation of your business. Here's how we protect it.
SOC 2 Type II
Planned — Not Yet Audited
GDPR
Working Toward Compliance
High Availability
Multi-Region Hosting
Encryption
In Transit
All data transmitted between your browser and our servers is encrypted with TLS 1.3. We enforce HTTPS on all connections and use HSTS headers.
At Rest
All database data is encrypted at rest using AES-256 encryption. Backups are encrypted with separate keys and stored in geographically redundant locations.
Authentication & Access Control
Magic link authentication (passwordless) with enterprise-grade auth infrastructure
Google OAuth 2.0 integration for social sign-in
Optional two-factor authentication (2FA) for admin accounts
Role-based access control (RBAC) with 6 distinct permission levels
Session tokens with configurable expiration and automatic rotation
Admin impersonation with full audit trail logging
API keys with scoped permissions and rate limiting
Monitoring & Fraud Prevention
Real-time fraud signal detection for suspicious panelist behavior
Trust scores calculated from multiple behavioral indicators
IP-based anomaly detection and geolocation verification
Comprehensive audit logs for all admin actions
Kill switches for immediate feature or access revocation
Automated alerts for unusual login patterns or data access
Infrastructure
Hosted on Vercel's edge network with automatic failover and DDoS protection
Managed PostgreSQL database with provider-managed recovery options
Provider-managed backups (retention varies by hosting tier)
Content Delivery Network (CDN) for global performance
Zero-downtime deployments with instant rollback capability
Incident Response
Our incident response process follows industry best practices:
Target: < 15 min
Detection & Triage
Target: < 1 hour
Initial Response
As required
Regulatory Notification
Target: < 5 days
Post-Incident Review
Compliance & Certifications
Working toward GDPR compliance — see our GDPR page for details
SOC 2 Type II audit planned (not yet started)
Working toward PIPEDA compliance (Canadian privacy legislation)
Third-party penetration testing planned for 2026
Data Processing Agreement (DPA) template available on request
Security questions?
Our security team is available to discuss your specific requirements.