One continuous workflow, brief to readout. No handoffs, no re-keying, nothing lost between steps.
Most tools do one piece and export the rest. BEYOND runs the whole study through the same five stages you will see in the platform, in one study record from start to finish.
Import or build the survey
Drop in the Word document or build from scratch. Logic, loops, quotas, and terminates mapped, editable, and tested end to end before launch.
Field with guardrails
Manage sample providers, quotas, and quality in one place. Speeder, fraud, and attention checks run live; you watch the field, not babysit it.
Tables ready at launch
Set up your banner, weighting, and house standards before fielding. Stat-tested tables are live from the first complete and update as data arrives.
Run the hard methods
MaxDiff, conjoint, Kano, TURF, segmentation, brand maps, on the same data, in the same place.
Build the readout
The deck, the dashboard, and the infographic, drafted from verified study evidence and shaped by a researcher, every number traced back to the tables.
AI accelerates. The platform verifies. Researchers decide.
The private BI Agents work inside the same governed study record as the questionnaire, the field data, the tables, the advanced analyses, the transcripts, and the deliverables. They cut repetitive work, help researchers cover more of the evidence, and build a stronger first pass. The platform keeps every fact tied to its source. Researchers stay responsible for the method, the interpretation, the recommendation, and the final work.
BI Agents accelerate
- Initial study and questionnaire builds
- Analysis support and pattern detection
- Transcript and open-end synthesis
- First-draft reports, dashboards, and toplines
The platform verifies
- Survey logic against the approved specification
- Bases, weighting, filters, and significance testing
- Numeric claims and source provenance
- Permissions, privacy, and audit history
Researchers decide
- Research design and methodological choices
- Which patterns are material
- How findings should be interpreted
- Caveats, recommendations, and final approval
Built by researchers. AI designed into the workflow from day one.
22+ analytics modules. One platform. No exports between them.
Elsewhere this is three subscriptions, a statistician, and a week of file passing. Here every method runs where the data already lives, with design tools, quality checks, and reporting built in.
Designed before launch. Estimated where the data sit. Returned as a simulator, a typing tool, or a priced scenario you can act on.
Research-grade methods, transparent settings
Some platforms sell a MaxDiff that is basic counting underneath. Ours runs true hierarchical Bayes. Every module follows established best practices with visible settings, diagnostics, and validation checks, and where methods have schools of thought, you choose the approach.
Heavy math, managed for you
Estimation jobs run on managed cloud compute sized to the task, with visible progress and reproducible outputs. HB models and segmentation runs that once meant overnight waits come back while the study is still your focus, without leaving the study record.
A model you can actually use
The output is a tool, not a table. Run scenarios in the conjoint simulator, score new respondents with the typing tool, read the demand curve and the revenue-optimal price, and put a spec through the Priority Grid optimizer. The answer stays attached to the study it came from.
Yourself, or with our specialists
Every module is built for a researcher to run without a statistics degree, and each ships with a training guide written by our team. Prefer a second set of hands? Our methodologists and data scientists will design, run, and interpret the analysis with you.
From verified evidence to a stakeholder-ready story, in the same workflow.
BI Agents assemble the first pass from verified study evidence. Researchers shape the storyline, challenge the interpretation, develop the recommendations, and approve what ships. Reports, dashboards, and infographics stay connected to the data underneath them, so the story can move quickly without losing its source. Not exports to fix in PowerPoint.
Reports
Full readouts with an executive summary, action titles, method-aware exhibits, and an appendix covering every question. Every number data-bound and sourced, in HTML and PowerPoint.
Dashboards
Live, filterable dashboards with your banner, KPI bands, and significance testing, built from the same study record and always current with the field.
Infographics
One-page visual stories for the stakeholders who will never open the deck: one hero finding, supporting stats, your brand kit, provenance intact.
Numbers you can defend to any stakeholder.
The industry's biggest worry about AI in research is simple: where did that number come from? On BEYOND, that question always has an answer.
Ours, not public AI
BI Agents are our private, study-scoped analysis agents. Study data is not used to train provider models under our approved configuration, and numeric claims are restricted to verified study evidence, each carrying its source, base, and analysis context.
Every figure sourced
Click any number in a deck or dashboard and see its question, its base, its weighting, and its test. Deliverables reconcile to the tables exactly.
Guarded in field
Fraud, speeder, and attention checks run during fieldwork with full audit trails, so the data underneath the numbers holds up too.
Know the sample, the quality, and the caveats behind every number.
Security tells a buyer the server is safe. Research confidence is a different question: why should anyone trust this finding? BEYOND keeps the answer attached to every result.
One study record, from setup to readout.
One study record, end to end
Setup, fieldwork, analysis, interpretation, and delivery run on the same study record, so nothing is re-keyed or reconciled between tools.
Advanced methods stay in place
MaxDiff, conjoint, segmentation, pricing, and text analytics run on the same data, in the same platform. No file passing, no extra vendors.
Every result keeps its context
Each reported number retains its source, base, weighting, and analytical context, so it stays defensible long after the study ships.
Survey changes flow through once. Tables, analytics, and deliverables stay aligned.
Built for the work that usually happens outside the survey platform.
Enterprise survey platforms are excellent at fielding surveys. The difference shows up in everything that happens after the data lands. Here is the same work, in BEYOND versus a traditional research stack.
Reflects common configurations of enterprise research stacks. Specific platform capabilities, add-ons, and negotiated terms vary.
Choose how you want to run the study.
Use the platform independently, bring in BEYOND specialists for selected stages, or have our team manage the work end to end. Other platforms sell software with a support tier; BEYOND also staffs senior insights executives who have led research on both the client and the supplier side, and they will run your study when you want them to. Same platform, same deliverables either way.
Your team runs it
Everything your team needs to run studies without a supplier, with software, training, and support.
- Program in hours, not weeks
- Tables ready while the study fields
- Advanced methods without a statistician on staff
- Deliverables generated, then yours to polish
Your team leads, ours assists
Your team owns the study; BEYOND specialists step in for the stages you choose: design, advanced methods, fieldwork, or reporting.
- Methodologists on the hard analytics
- Questionnaire and design review
- Report and story shaping
- As much or as little as the study needs
Our team runs it
When bandwidth is short or the stakes are high, BEYOND's senior researchers run the engagement end to end on the same platform, with complete visibility for you throughout.
- Design, field, analyze, and present, done for you
- Led by executives with client-side and supplier-side careers
- Not a partner marketplace or add-on consultancy
- Scale up for a launch, back down after
Most clients do both: run the routine studies in-house and bring us in when bandwidth or complexity calls for it.
And pricing follows commitment: license the platform or commit to a program of studies, and the per-study cost comes down. Single projects are always welcome.
Your standards, your norms, and your study assets, in one place.
Your institutional memory
Reusable questions, scales, screeners, and logic blocks. Standards live in one place, and every new study starts from them instead of from scratch.
Your norms database
Bring every wave of a tracker, ad test, or concept test into one governed home. Compare wave over wave, score new results against your norms, and watch brand health move, with versioning and provenance on all of it.
Balance to the population
Built-in US Census data for demographic balancing and RIM weighting targets, so representativeness is a setting, not a side project.
Every asset, one place
Deliverables, datasets, data maps, and banner books, versioned, dated, and role-based, persistent for the life of the engagement.
Qualitative research, run in the same place.
Boards, focus groups, and interviews with a dozen interactive exercises, a topline after every session, full transcripts with cross-session analysis, and highlight reels your stakeholders will actually watch. Run it standalone, or connect it to a survey and recruit participants who arrive with their answers attached.
See Qual Studios →Illustrative example built to show the format. Client findings are confidential and are never used as marketing material.
Enterprise trust, built into the workflow.
Research data is customer data. BEYOND treats it that way at every step, not as a compliance page afterthought.
Identity and access
Role-based permissions, two-factor authentication, scoped client access, and study-level controls.
Encryption and isolation
Encryption in transit and at rest, with study and organization data isolated throughout the workflow.
Private AI
Study-scoped, server-to-server AI processing. Study data is not used to train provider models under our approved API configuration.
Privacy and data rights
Defined retention, access, export, and deletion workflows, with DPA and privacy support appropriate to each engagement.
Audit and provenance
Key user, agent, export, and analysis actions are traceable, and reported figures retain their source, base, weighting, and analytical context.
Infrastructure assurance
Hosted on SOC 2 Type II-certified infrastructure, with hardened database security and row-level access controls.
Learn more about our Security and Compliance
Database infrastructure: SOC 2 and GDPR
Our database infrastructure maintains SOC 2 Type II certification and full GDPR compliance. All respondent data is stored in SOC 2 certified data centers with encryption at rest (AES-256) and in transit (TLS 1.2+).
SOC 2 Type II
Our database infrastructure undergoes annual SOC 2 audits covering security, availability, processing integrity, confidentiality, and privacy. Audit reports are available on request.
GDPR compliance
Data processing agreements (DPAs) are available. Right to deletion is supported via respondent data purge. Consent timestamps are captured on intro pages.
Encryption at rest
All data is encrypted with AES-256 at the storage layer. Database backups are encrypted. Encryption keys are managed by the cloud provider's key management service.
Encryption in transit
All connections use TLS 1.2 or higher. Our database infrastructure enforces SSL for all database connections, and API endpoints are served over HTTPS only.
Data residency
The database is hosted in a US-East region, and data does not leave the deployment region. EU hosting is available if required.
Application security
Row-level security
Row-level security policies enforce access control at the database layer. Even if application code has a bug, the database rejects unauthorized queries.
Server-only admin credentials
Admin operations use elevated server-only credentials that are never exposed to the browser or to client code.
IP hash privacy
Respondent IP addresses are hashed (SHA-256) before storage. Original IPs are never persisted, and the hash is used only for duplicate detection.
Input sanitization
All respondent inputs are sanitized for XSS, script injection, and SQL injection. Embedded data from URL parameters is sanitized and length-capped.
Session token security
Session tokens are cryptographically random UUID v4 values, validated server-side on every API call. There is no JWT or client-side token verification.
Admin authentication and access
Access to the admin platform is protected by a layered authentication stack: HMAC-signed sessions, mandatory two-factor authentication, brute-force rate limiting, a full login audit trail, and per-account network restrictions.
Mandatory two-factor authentication
TOTP-based 2FA (RFC 6238) is required for every admin account and works with any standard authenticator app. Login is two-step (password, then a six-digit code), and one-time recovery codes cover lost-device access.
HMAC-signed sessions
The session identity cookie is signed with an HMAC and verified on every request, both in middleware and server-side. A tampered or forged cookie is rejected outright, and cookies are httpOnly and Secure.
Brute-force rate limiting
A rolling time window temporarily blocks sign-in after repeated failed attempts for a single account or from one IP address. Both the password step and the 2FA code step count toward the limit.
Login audit trail
Every sign-in attempt (success, failed password, failed 2FA, or rate-limit block) is logged with IP address, user agent, and timestamp. Recent activity is visible to owners in the Users panel.
IP allowlisting
External client accounts can be restricted to specific IP addresses or IPv4 CIDR ranges. An off-list sign-in is refused even with the correct password, and the allowlist is re-checked on every request.
Scoped client access
External accounts are confined to named studies and a defined set of navigation tabs. They cannot enumerate, open, or edit other clients' projects, and survey scripts are review-only to them.
Self-service password reset
Reset issues a single-use, SHA-256-hashed token by email with a one-hour expiry, rate-limited per address; the raw token is never persisted. Owners can also set a password directly from the Users panel.
Short-lived client sessions
External client sessions last one day, versus seven days for internal staff, so client access re-authenticates with 2FA daily.
View our InfoSec questionnaire
Answers to controls covered in the overview (encryption at rest and in transit, SOC 2, data residency, access roles, mandatory two-factor authentication, and IP hashing) are summarized there. This questionnaire covers the rest of a standard vendor assessment.
Organization and governance
Does your organization have a dedicated information security function?
Yes. BEYOND Insights maintains an information security program overseen by executive leadership. Security controls are implemented at the infrastructure level through Supabase (SOC 2 Type II certified) and Vercel (SOC 2 Type II certified), with application-level controls managed by the engineering team.
Do you have a written information security policy?
Yes. Our security practices follow industry standards for SaaS platforms handling research data. Policies cover data handling, access control, incident response, and acceptable use.
Do you conduct regular security assessments or penetration testing?
Infrastructure security is continuously monitored by Supabase and Vercel. Application code undergoes regular security audits covering OWASP Top 10 vulnerabilities, using a combination of automated static analysis and manual code review. Third-party assessment summaries can be discussed under NDA.
Do you have an incident response plan?
Yes. Our incident response process includes detection (automated monitoring), containment, investigation, notification (within 72 hours per GDPR for confirmed breaches affecting personal data), and remediation. Supabase provides 24/7 infrastructure monitoring with automated alerts. The detailed runbook is available for review under NDA.
Data retention, deletion, and privacy
What types of personal data do you collect?
Survey responses, IP address hashes (not raw IPs), browser user agent, device type, timestamps, and optional embedded data from panel URLs (for example, a respondent ID or source ID). We do not collect names, email addresses, or direct identifiers unless a client explicitly includes them as survey questions.
How long is data retained?
Data is retained for the duration of the study plus a client-configurable retention period. Data deletion is available on request, and Supabase backups follow the configured retention window.
Can individual respondent data be deleted on request?
Yes. Respondent records, answers, page events, quality flags, and all associated data can be purged per individual respondent or in bulk per study.
Do you have a Data Processing Agreement (DPA)?
Yes. Supabase provides GDPR-compliant DPAs, and BEYOND Insights can execute DPAs with clients covering our role as data processor for survey research data.
Do you process data under CCPA and CPRA?
The platform supports CCPA compliance. We do not sell personal information, and respondent data is processed solely for market research purposes as defined in the study scope.
Network security
Is a Web Application Firewall (WAF) in place?
Vercel provides DDoS protection and rate limiting at the edge, Supabase includes built-in rate limiting on API endpoints, and application-level rate limiting is implemented per panel source.
Are there network segmentation controls?
Yes. The database is not directly accessible from the internet; all access goes through the Supabase API layer, which enforces Row-Level Security policies. Admin and respondent API endpoints are logically separated.
How are API endpoints protected?
Admin endpoints require authenticated session cookies with role validation, and survey endpoints require valid session tokens. Rate limiting prevents abuse, and input validation and sanitization are applied on all endpoints.
Vulnerability and patch management
How are vulnerabilities managed?
Dependencies are monitored for known vulnerabilities, and security patches are applied promptly. Application code undergoes regular review for OWASP Top 10 vulnerabilities.
Is there protection against common web attacks?
Yes. Protection includes XSS (input sanitization, React escaping, Content Security Policy), SQL injection (parameterized queries via Supabase), CSRF (Origin header validation), clickjacking (X-Frame-Options), and session fixation (server-generated tokens).
Subprocessors
What third-party services and subprocessors do you use?
Supabase (database, storage, authentication), Vercel (hosting, CDN, serverless compute), Anthropic Claude (optional AI-powered text analytics; data is not stored by Anthropic), and Sentry (error monitoring). Error reports are scrubbed before they are sent: request bodies, query strings, cookies, headers and user identity are removed, so they carry the exception and the route but no respondent answers or identifiers. No respondent data is shared with advertising or analytics services.
Do you run advertising or analytics tracking on your own sites?
Our public marketing pages run a LinkedIn Insight Tag for advertising measurement. It never runs on the admin application, on any survey, or on any respondent-facing surface, and it is covered by an automated test that asserts both its presence on the marketing pages and its absence everywhere else.
Do subprocessors have access to client data?
Supabase hosts the database and has technical access per their DPA. Vercel processes API requests in transit. Anthropic Claude processes open-end text only when explicitly invoked by the admin user, under Anthropic's data usage policy (no training on API data).
How are subprocessors vetted?
All subprocessors maintain SOC 2 Type II certification. Supabase and Vercel are established enterprise infrastructure providers with published security practices and available data processing agreements.
Business continuity and disaster recovery
What happens if your primary service goes down?
Vercel's serverless architecture automatically routes around failures, and Supabase provides automatic failover on the Pro tier. Survey data is persisted on every page save, so respondents can resume after any interruption.
Is there a disaster recovery plan?
Yes. Supabase provides automated daily backups with point-in-time recovery (PITR). The application is stateless (serverless), so infrastructure recovers automatically, and the database can be restored to any point within the retention window.
How quickly can you recover from a data loss event?
Point-in-time recovery allows restoration to any point within the retention window. The recovery point objective is near-zero for committed transactions, and the recovery time objective is minutes for a database restore and seconds for application redeployment.
What is your uptime commitment?
Supabase Pro provides a 99.9% uptime SLA for the database, and Vercel provides 99.99% uptime for the edge network and CDN. Application availability depends on both services.
Can data be exported if the platform is discontinued?
Yes. Full data export is available in XLSX, CSV, and JSON formats at any time via the admin platform, and raw database access is available via the Supabase dashboard for bulk extraction.
You do not have to move everything at once.
Start with one study
Keep your existing stack in place
Use BEYOND where it helps most
Expand on your schedule
Does BEYOND replace our current survey platform?
It can, but it does not have to on day one. Most teams start with a single study on BEYOND while their existing stack keeps running, then move more work over as the workflow proves itself.
Can we license the platform without using BEYOND services?
Yes. The platform is fully self-serve, with training and support included. The senior research team is there when you want it, not a requirement.
Can BEYOND run the engagement for us?
Yes. Under the Managed model, BEYOND's senior researchers design, field, analyze, and present the study on the same platform, with complete visibility for your team throughout.
How does the AI use our data?
BI Agents are private and study-scoped. Processing is server to server, study data is not used to train provider models under our approved configuration, and every numeric claim an agent makes traces to verified study evidence.
Can we start with one study?
Yes, and we recommend it. Bring a brief or a recent study to the demo and we will show the workflow from setup to final deliverable. No platform migration required.
Which advanced methods are included?
MaxDiff, choice-based conjoint, segmentation, text analytics, significance testing, and banner and grid-banner analysis, among others, all running on the same study record. The full inventory, with training guides, is on the Analytics page.
We have a sensitive or proprietary study. How fast can an NDA be in place before we discuss it?
Quickly, often within a day. Because nearly all of our work is proprietary, client-owned, and confidential, we are set up to put a mutual NDA in place before any project specifics are discussed. We are happy to work from your paper or provide our standard mutual agreement, whichever is faster for your legal team.
How does project billing and payment typically work?
Engagements are scoped and billed per project, or under an annual platform license for teams running continuously. We confirm scope, deliverables, and timing up front, and we are happy to work within your standard procurement and payment terms.
How many people on our team can access the platform? Are seat licenses required?
Platform access is available per engagement or as an annual license, priced by seat: your team holds one full seat, with a reduced rate for each additional seat. Internal users receive role-based accounts (owner, collaborator, or viewer), while external client accounts are scoped to named studies and a defined set of tabs, so each person sees exactly what they should and nothing more.
Can we export results?
Yes. Tables, analysis outputs, and finished deliverables all export for stakeholder use, including formatted Excel with stat testing intact and presentation-ready reports in both HTML and native, editable PowerPoint. Your outputs are yours to take with you.
What studies has BEYOND conducted that have been released publicly?
The large majority of our work is proprietary and confidential to the clients who commissioned it. For publicly shareable examples of our approach: the Beauty Brand Blueprint segments the U.S. prestige beauty market into distinct consumer groups and maps loyalty, brand momentum, and switching behavior, using consumer segmentation, structural equation modeling, and a proprietary loyalty-prediction model. The Cancer and Careers synthesis benchmarks employer readiness against the lived reality of employees managing cancer. We are happy to walk you through either, or through anonymized case studies relevant to your category, on request.
From leaders who ran insights functions at major brands, and researchers who shaped practices at top suppliers.
We know what an insights team needs because we have been one, and what a supplier owes you because we are one. See both in a working demo, or start with our capabilities deck.
Bring a brief or a recent study. We will show the workflow from setup to final deliverable.