Security and compliance

Where the data lives

Hosting

One server in Toronto, Canada, at FastComet. Not in the EU. Every service that receives data, with its location, is listed on Sub-processors.

EU transfers

Canada holds an EU adequacy decision, which is what transfers from the EU rest on. Whether that is enough for your case is for your own legal advice.

Network

All traffic passes through Cloudflare. HTTPS only; plain HTTP is redirected.

At rest

The server's disks are encrypted by the hosting provider.

Backups

The hosting provider backs up the server and keeps backups for one month, so deleted data can remain in a backup for up to a month before it ages out.

What we never collect from respondents

No account

People answer through a link. No sign-in, name or email is ever asked for.

No IP address

Responses are stored without an IP address or any device identifier.

No tracking

No cookies by default, and nothing that follows a respondent: no advertising or cross-site trackers. One optional cookie, holding a random token, exists only if a respondent ticks the box to receive an anonymous follow-up question.

No training, no ads

Data is never sold or used for advertising. Optional AI summaries run only when the form owner asks, through Anthropic's API, which does not train on it.

How accounts are protected

Two-factor sign-in

On every plan, Free included: an authenticator app (Microsoft or Google Authenticator, or any TOTP app) plus ten single-use recovery codes. A password reset does not get past it.

Passwords

Stored only as bcrypt hashes; at least 8 characters; passwords found in known breaches are refused.

Sign-in

Failed attempts are limited per address and per account, and sign-in is protected by a privacy-friendly bot check (Cloudflare Turnstile). Changing the password signs out every other device.

Teams

On the Team plan, each person has their own login with a role: owner, admin, member or viewer.

Web attacks

Prepared statements for every database query, CSRF tokens on every form, escaped output, and owner pages that cannot be framed.

Your data, your controls

Retention

Each form can delete its responses automatically after 30, 90 or 365 days. Deleting a form deletes its responses at once; deleting the account deletes everything.

Export

Responses can be read online on every plan, and exported as CSV on paid plans. Your whole account can be downloaded as JSON from Settings.

Reporting channels

Reports are kept for three years after a case is closed and then deleted automatically, with every action on a case recorded in its audit trail.

Laws the product is built for

GDPR

Privacy by construction (no respondent IPs, no cookies by default, configurable retention), a published privacy policy and a data processing agreement on request at [email protected]. GDPR is a practice we can describe, not a certificate anyone issues.

Whistleblowing

The reporting channel is built for the EU Whistleblowing Directive, Germany's HinSchG (acknowledgement within 7 days, feedback within 3 months, 3-year retention) and France's Sapin II. See the reporting channel page.

Accessibility

The answering form is designed and tested against WCAG 2.1 AA, with a self-evaluated accessibility statement and VPAT.

Breach notice

Affected customers are told without undue delay, and within 72 hours of us becoming aware of a breach that touches their data.

What we do not have

For reviewers