Your respondents trusted you. We take that seriously.

Infrastructure and security

Encryption in transit

TLS on all surfaces. HTTPS is enforced across the application, API, and marketing site.

Access controls

Role-based access within accounts, including a staff and client seat model for agencies. Multi-factor authentication is built in — authenticator app (TOTP), email one-time codes, backup codes, and trusted devices. SAML 2.0 and OpenID Connect SSO are available on Pro and above.

Audit logs

User actions are audit-logged across the application. What customers can view today is scoped: per-response edit history on Growth and above, and an audit log for workflow operations. Account-wide audit records are available on request rather than self-serve.

Payment security

Payments are processed by Paddle as Merchant of Record. Card numbers and security codes are entered with Paddle and never reach SurveyRock; we keep only the brand, last four digits and expiry date of the card on file. PCI DSS obligations sit with Paddle.

Data privacy

Data ownership

Your survey data and your respondents’ answers are yours. We don’t sell them, we don’t mine them for advertising, and we don’t train AI models on them. AI governance detail →

Deletion requests

Data-subject deletion requests are honored under our GDPR data-subject request process.

Sub-processors

Every third party that processes data on our behalf is listed publicly, with what each one does and where. This includes our AI providers and our analytics provider. View sub-processors →

Compliance — what we hold, what we're building toward

AI and data governance

AI features in SurveyRock operate under three commitments: your response data never trains AI models; AI runs only when you invoke it; and AI providers never gate your data — collection and exports work even if every AI provider is down.

Responsible disclosure

Found a security issue? Tell us directly and we'll respond fast — we commit to acknowledging reports within 2 business days. We don't operate a paid bounty program, but we credit researchers who report responsibly, with permission, and we don't pursue good-faith research.

Data Processing Agreement

EU customers, and anyone processing personal data through SurveyRock, can read and download our DPA directly — no request needed. It covers processing scope, sub-processors, security measures, and breach notification, and is automatically incorporated into your Terms when you process Personal Information of EU/UK residents through the Service.