Security

1. Isolation and access control

• Row-level security. Every table that holds customer or participant data has database policies that restrict each request to the records its signed-in user is allowed to see. A bug in application code cannot by itself expose another workspace’s data.
• Roles. Workspaces have owner, admin, editor and viewer roles. Enterprise workspaces can enforce SAML single sign-on and provision users with SCIM.
• Staff access is limited to people who need it to run the service, and privileged actions are written to an audit log with the actor, action and time.

2. Encryption

• All traffic uses HTTPS (TLS). We send HTTP Strict Transport Security and a strict Content Security Policy.
• Data is encrypted at rest by our database provider.
• Invitation email addresses are stored encrypted with AES-256-GCM only when a survey uses reminders; otherwise we keep only a one-way hash. They are cleared when the survey closes.
• IP addresses used for abuse prevention are stored as hashes, not in plain form.

3. Survey links and responses

• Panel survey links are cryptographically signed and single-use, so they cannot be guessed, shared or replayed to earn a reward twice.
• Anonymous mode stops a survey from storing device fingerprints and browser details with responses.
• On anonymous surveys, filtered views and cross-tabs hide any group with fewer than 5 respondents, so small groups cannot be singled out.
• Results pages can be shared read-only and protected with a password.

4. Payments

Card payments are handled on Stripe’s hosted checkout and participant payouts by PayPal. Card and bank details never reach SurveyHood’s servers. Payment webhooks are verified by signature before we act on them.

5. Application security

• Rate limits on sign-in, quotes, invitations, AI features, data exports, analytics and the API.
• API keys are scoped (read or write) and can be revoked at any time. Outgoing webhooks are signed and are never sent to private or internal network addresses.
• Automated tests run on every change, including database permission tests and accessibility checks.

6. Retention and deletion

Data is deleted or anonymised automatically on a published schedule; see the retention table in our Privacy Notice. Account deletion has a 30-day cooling-off period, after which personal details are removed.

7. Incidents

If we become aware of a breach affecting personal data, we will investigate, contain it and notify affected customers without undue delay, and within 72 hours for customers covered by our Data Processing Addendum, as well as regulators and individuals where the law requires.

8. Reporting a vulnerability

Email support@surveyhood.com with “Security” in the subject and enough detail for us to reproduce the issue. Please give us reasonable time to fix it before disclosing it, do not access or change other people’s data, and do not run tests that degrade the service. We will acknowledge your report and keep you updated, and we will not take legal action against good-faith research that follows these rules.