Security & Trust
Last updated 2026-06-24
Compliance & certifications
We operate controls aligned to the SOC 2 Trust Services Criteria and are pursuing a SOC 2 Type II report (scoped to Security, Availability, and Confidentiality; audit window to be scheduled). We are GDPR-aligned and are aligning our broader program and AI governance to ISO 27001, ISO 27701, and ISO 42001. We do not yet hold these certifications and do not claim them as achieved.
Security measures
Infrastructure security
- Hosted on Railway (application) and Supabase (Postgres / Auth / Storage) in AWS us-east-1.
- TLS encryption in transit and disk-level encryption at rest.
- Managed, regularly-patched cloud infrastructure.
Access control & authentication
- Authentication via Supabase Auth (email + password and Google OAuth).
- Role-based access control — admin, creator, editor, and viewer roles scoped at client and project level.
- TOTP multi-factor authentication available; AAL2 login enforcement in progress.
- Application-layer tenant access checks plus an additive tenant guard; access decisions are enforced in application code.
Network & application security
- Secure HTTP response headers and a Content-Security-Policy.
- CORS allowlist and request rate-limiting.
- Input validation on API boundaries.
Secure development (SDLC)
- Secret scanning (gitleaks, blocking) and static analysis (semgrep) in CI.
- Automated dependency updates (Dependabot) and deterministic, self-hosted-font builds.
- Code review on changes before release.
Logging & monitoring
- Central audit-log table with middleware coverage of authenticated mutations; coverage is expanding.
- Error tracking with PII scrubbing, plus per-request correlation ids on the API.
- Centralized log aggregation and distributed tracing via vendor-neutral OpenTelemetry, with respondent free-text and PII redacted before any telemetry leaves our systems (rolling out).
- Uptime monitoring and alerting are rolling out; public incident communications are not yet available.
AI governance
- No training on customer data — and our AI subprocessors are contractually barred from training on it.
- Eval harnesses gate AI model and prompt changes; an LLM-as-judge auditor reviews analysis quality.
- Human-in-the-loop review of generated analysis before delivery.
No AI training on customer data
InsightsHero’s engineering policy is not to train AI models on customer data. Applicable provider no-training terms must be verified as part of the provider-contract gate. Our AI providers are listed on our Subprocessor page.
WhatsApp clarification:our participant survey experience is our own cosmetically styled application with no Twilio or WhatsApp Business API. A distinct Meta CAPI recruitment capability is prospective and is not approved for production. Its listing does not establish a provider role, transfer mechanism, contract, or activation; those require counsel, provider, notice, platform-owner, administrator, and exact-environment approvals. Separately, a per-survey browser Meta Pixel (off by default) can be enabled for ad conversion measurement: only on surveys with the pixel configured, Meta receives click/cookie identifiers, user agent, IP address (inherent to a browser request), page URL, and a pseudonymous completion event — never answers or contact data; the survey's welcome card discloses it.
Privacy & GDPR
Our published privacy, DPA, role-allocation, and international-transfer materials are engineering drafts pending counsel review; they are not executed terms or a representation that any prospective provider transfer is approved. We provide data-subject-request tooling and a published prospective subprocessor list. Read our Privacy Policy, our Cookie Policy, and our Subprocessor list. A Data Processing Agreement is available on request.
Vulnerability management & penetration testing
We run automated secret scanning, static analysis, and dependency monitoring in our development pipeline. An independent third-party penetration test is scheduled as part of our security roadmap; results and a summary letter will be available to customers under NDA once complete. To report a vulnerability, email [email protected] or see our security.txt.
Request security documentation
For our SOC 2 readiness materials, Data Processing Agreement, security overview, completed security questionnaires (CAIQ / SIG), or other due-diligence documentation, contact our security team. Some documents are shared under NDA.