Security

1. Our approach

SRVY handles data that people share in confidence: survey responses, including anonymous ones, contact details for invitations, and the accounts of the workspace users who run surveys. This page describes the security measures we operate. They run in production, and we describe them without claiming certifications we do not hold.

2. Hosting and infrastructure

SRVY runs on dedicated infrastructure provided by Hetzner Online GmbH. Our current hosting location is documented operationally. Application servers, the database, uploaded files, and backups run in this environment. The database host is not exposed to the public internet and is reachable only from our own application tier over a private network. Administrative access is restricted to known addresses. Hetzner operates ISO 27001-certified data centres as our infrastructure provider.

Some ancillary services, in particular transactional email and analytics, are provided by subprocessors that may process limited personal data outside the EEA under appropriate safeguards. The current list is in the annex to our Data Processing Agreement.

3. Encryption

• In transit: TLS (HTTPS) on all public traffic, terminated at our managed load balancer with a managed, automatically renewed certificate.
• Credentials: workspace-user passwords are stored as one-way hashes using the platform's standard password hashing. They are never stored in plain text or written to any log.
• Email addresses: addresses used for tokenised links and suppression are stored as keyed HMAC-SHA256 hashes, so that unsubscribe and bounce suppression can be enforced without keeping the plain address where it is not needed.
• Backups: off-site copies are transferred over SSH, so they are encrypted in transit to separate storage.

4. Authentication and access control

• Password sign-in with database-backed session tokens, delivered as HttpOnly, host-only per-surface cookies and re-validated against the database on every request.
• Sign-in returns a uniform error that does not reveal whether an account exists, and the session identifier is regenerated on login.
• Role- and permission-based access control for workspace users.
• CSRF protection on every state-changing request.
• The admin portal uses a separate sign-in, cookie, and authorisation path from the customer Insight portal.

5. Data isolation

SRVY is multi-tenant, and each workspace's data is kept separate. For workspace-owned email data (contacts, subscriptions, lists, and distributions), the data-access layer is built around an enforced workspace scope, so a query against that data cannot be issued without naming a single workspace. Access to a workspace's surveys, responses, and analytics is restricted to that workspace's authorised users through the application's authorisation checks. Respondent anonymity is enforced separately, as described in our Privacy Policy, so answers to a survey are held apart from any identity or invitation.

6. Backups and disaster recovery

• Automated database backups run daily on the database host and are then mirrored off-site to separate storage (a Hetzner Storage Box) over SSH.
• Retention follows a grandfather-father-son schedule: 7 daily, 4 weekly, and 12 monthly copies, rotated automatically.
• Restore procedures are documented so a backup can be recovered when needed.

7. Monitoring and logging

We keep durable logs of email deliveries, bounces, and complaints, and an append-only audit trail of changes to company registry identities. Sign-in records a last-login timestamp, and server-level logs capture errors and operational events. Logs are retained for a limited period and used to investigate issues and abuse.

8. Vulnerability management

We keep operating systems and runtime dependencies patched, review third-party libraries before adopting them, and address reported issues on a priority basis, handling urgent ones out of band.

9. Subprocessors

A limited number of subprocessors process personal data in the United States, under Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. See the annex to our Data Processing Agreement for the current list, and our Privacy Policy for how this fits together.

10. Responsible disclosure

If you believe you have found a security vulnerability in SRVY, please email security@srvy.app with details and, where possible, steps to reproduce. We aim to acknowledge reports within two business days. We will not pursue legal action against researchers who act in good faith, test only against their own accounts, and avoid disruption or privacy violations affecting other users or respondents.

11. Contact

HR Cluster AS
Security: security@srvy.app
Privacy: privacy@srvy.app