Security
Your security settings live at /user/security — open the avatar menu and choose Security. The page has tabs for Active Sessions, Two-Factor Auth, Trusted Devices, Login History, Security Alerts and Connected Accounts.
Two-factor authentication and every session feature are available on all plans, including Free. They are not gated.
Two-factor authentication
Section titled “Two-factor authentication”Two methods are supported:
- Authenticator app (TOTP) — any standard app, scanned from a QR code.
- Email verification — a one-time code sent to your account email.
When you enable it you also get 10 backup codes. Each is single-use, and you can regenerate the set at any time from Regenerate Codes — regenerating invalidates the old ones.
A device you mark as trusted stays trusted for 30 days, after which it challenges you again.
Two-factor is enforced at login once you enable it on your own account. There is currently no way for an account owner to require two-factor across their whole team — each person enables it for themselves.
If you chose email verification and no code arrives on the first prompt, click Resend code. This is a known issue: the first challenge does not always send the code, and the resend does.
Active sessions and trusted devices
Section titled “Active sessions and trusted devices”The Active Sessions tab lists where your account is signed in and lets you:
- Revoke an individual session
- Sign Out All Other Devices — ends every session except the one you are using
- Sign Out Everywhere — ends all of them, including the current one
Changing your password also signs out all your other devices.
Sessions last 30 days, or 90 if you chose “remember me” when signing in. There is no configurable idle timeout — a session ends when it expires or when you revoke it.
A display issue to be aware of: the “Current Session” and “Trusted” badges currently appear on every row rather than only the relevant one. The underlying data is correct and revoking works properly; only the badge placement is wrong.
Passwords
Section titled “Passwords”Passwords must be at least 12 characters. There is no requirement to mix character types — length does more for you than symbol rules do.
Three checks run on every new password:
- It cannot appear in a list of commonly-used passwords.
- It is checked against Have I Been Pwned, so a password exposed in a known public breach is refused. This uses k-anonymity: only a partial hash prefix leaves our servers, never your password.
- It cannot contain your email address or username.
Change your password from /user/profile, not the Security page.
Protection against password guessing
Section titled “Protection against password guessing”Repeated failed sign-ins are rate-limited per IP address and per account, within a rolling fifteen-minute window, with the delay increasing as attempts continue. Past a threshold, a verification challenge is added.
This is automatic and needs no configuration.
Single sign-on
Section titled “Single sign-on”SAML 2.0 and OpenID Connect are available on Pro and above, configured per workspace under Workspace Settings → SSO. You supply your identity provider’s metadata; we do not need credentials of our own for it.
If you are setting up SSO for the first time, contact us — we would rather walk through the first configuration with you than have you discover a mismatch at the login screen.
Roles and access
Section titled “Roles and access”Five built-in roles:
| Role | Surveys | Sending | Results | Can see PII | Delete surveys | Account admin |
|---|---|---|---|---|---|---|
| Owner | Full | Full | Full | Yes | Yes | Members, settings, branding, billing |
| Admin | Full | Full | Full | Yes | Yes | Members, settings, branding — not billing |
| Editor | Full | Full | Full | No | No | None |
| Viewer | View only | No | View only | No | No | None |
| No access | None | None | None | No | No | None |
The practical differences worth knowing: Admin cannot touch billing — that is Owner only. And Editor cannot see personally identifiable information in responses or delete surveys, which is usually the right default for someone building surveys rather than administering the account.
Custom role presets, permission groups and directory sync are Enterprise features. See Directory sync (SCIM).
Encryption
Section titled “Encryption”- In transit — TLS across the application, the API and the marketing site.
- At rest — the database, file storage and cache are all encrypted at rest.
Your data
Section titled “Your data”Data export, correction, consent preferences and account deletion are at /gdpr/data-privacy-view. That page is not currently linked from the main navigation, so go to it directly.
Retention rules can be set per survey or as an account default, and a nightly job removes data past its retention window. Masking of personally identifiable information in responses is available on Team and above.
If you turn on anonymous responses for a survey, that survey does not record the respondent’s IP address, device or country against their answers.
Certifications — where we actually stand
Section titled “Certifications — where we actually stand”We would rather be plain about this than let a page imply otherwise.
- GDPR — we align with it. A DPA is available.
- SOC 2 Type II — not held. On our roadmap.
- ISO 27001 — not held. On our roadmap.
- HIPAA — not available. Until it is, we will not accept protected health information or sign a BAA.
If your procurement process requires a certified vendor today, we are not that vendor yet. Tell us your timeline and we will tell you honestly whether it matches ours.