Built to clear enterprise security review.
Insights and procurement teams ask hard questions about data handling. This page summarizes how the platform protects respondent and client data, and provides standard answers to the questions that come up most often in a security review.
Note: this page is written for open review. Full operational detail, including provider audit reports, the incident response runbook, and configuration specifics, is available to your security team under NDA.
Security and compliance overview
The platform runs on SOC 2 Type II certified providers, with encryption in transit and at rest, role-based access, mandatory two-factor authentication for admin accounts, and audit trails across sensitive actions. The detail below mirrors the compliance posture shared with security and procurement teams.
Database infrastructure: SOC 2 and GDPR
Our database infrastructure maintains SOC 2 Type II certification and full GDPR compliance. All respondent data is stored in SOC 2 certified data centers with encryption at rest (AES-256) and in transit (TLS 1.2+).
SOC 2 Type II
Our database infrastructure undergoes annual SOC 2 audits covering security, availability, processing integrity, confidentiality, and privacy. Audit reports are available on request.
GDPR compliance
Data processing agreements (DPAs) are available. Right to deletion is supported via respondent data purge. Consent timestamps are captured on intro pages.
Encryption at rest
All data is encrypted with AES-256 at the storage layer. Database backups are encrypted. Encryption keys are managed by the cloud provider's key management service.
Encryption in transit
All connections use TLS 1.2 or higher. Our database infrastructure enforces SSL for all database connections, and API endpoints are served over HTTPS only.
Data residency
The database is hosted in a US-East region, and data does not leave the deployment region. EU hosting is available if required.
Application security
Row-level security
Row-level security policies enforce access control at the database layer. Even if application code has a bug, the database rejects unauthorized queries.
Server-only admin credentials
Admin operations use elevated server-only credentials that are never exposed to the browser or to client code.
IP hash privacy
Respondent IP addresses are hashed (SHA-256) before storage. Original IPs are never persisted, and the hash is used only for duplicate detection.
Input sanitization
All respondent inputs are sanitized for XSS, script injection, and SQL injection. Embedded data from URL parameters is sanitized and length-capped.
Session token security
Session tokens are cryptographically random UUID v4 values, validated server-side on every API call. There is no JWT or client-side token verification.
Admin authentication and access
Access to the admin platform is protected by a layered authentication stack: HMAC-signed sessions, mandatory two-factor authentication, brute-force rate limiting, a full login audit trail, and per-account network restrictions.
Mandatory two-factor authentication
TOTP-based 2FA (RFC 6238) is required for every admin account and works with any standard authenticator app. Login is two-step (password, then a six-digit code), and one-time recovery codes cover lost-device access.
HMAC-signed sessions
The session identity cookie is signed with an HMAC and verified on every request, both in middleware and server-side. A tampered or forged cookie is rejected outright, and cookies are httpOnly and Secure.
Brute-force rate limiting
A rolling time window temporarily blocks sign-in after repeated failed attempts for a single account or from one IP address. Both the password step and the 2FA code step count toward the limit.
Login audit trail
Every sign-in attempt (success, failed password, failed 2FA, or rate-limit block) is logged with IP address, user agent, and timestamp. Recent activity is visible to owners in the Users panel.
IP allowlisting
External client accounts can be restricted to specific IP addresses or IPv4 CIDR ranges. An off-list sign-in is refused even with the correct password, and the allowlist is re-checked on every request.
Scoped client access
External accounts are confined to named studies and a defined set of navigation tabs. They cannot enumerate, open, or edit other clients' projects, and survey scripts are review-only to them.
Self-service password reset
Reset issues a single-use, SHA-256-hashed token by email with a one-hour expiry, rate-limited per address; the raw token is never persisted. Owners can also set a password directly from the Users panel.
Short-lived client sessions
External client sessions last one day, versus seven days for internal staff, so client access re-authenticates with 2FA daily.
Answers to the rest of a standard vendor assessment
These answers are organized by the categories most commonly requested in vendor security assessments and procurement reviews. They describe the platform at a level appropriate for open publication; deeper specifics are available under NDA.
Answers to controls covered in the overview (encryption at rest and in transit, SOC 2, data residency, access roles, mandatory two-factor authentication, and IP hashing) are summarized there. This questionnaire covers the rest of a standard vendor assessment.
Organization and governance
Does your organization have a dedicated information security function?
Yes. BEYOND Insights maintains an information security program overseen by executive leadership. Security controls are implemented at the infrastructure level through Supabase (SOC 2 Type II certified) and Vercel (SOC 2 Type II certified), with application-level controls managed by the engineering team.
Do you have a written information security policy?
Yes. Our security practices follow industry standards for SaaS platforms handling research data. Policies cover data handling, access control, incident response, and acceptable use.
Do you conduct regular security assessments or penetration testing?
Infrastructure security is continuously monitored by Supabase and Vercel. Application code undergoes regular security audits covering OWASP Top 10 vulnerabilities, using a combination of automated static analysis and manual code review. Third-party assessment summaries can be discussed under NDA.
Do you have an incident response plan?
Yes. Our incident response process includes detection (automated monitoring), containment, investigation, notification (within 72 hours per GDPR for confirmed breaches affecting personal data), and remediation. Supabase provides 24/7 infrastructure monitoring with automated alerts. The detailed runbook is available for review under NDA.
Data retention, deletion, and privacy
What types of personal data do you collect?
Survey responses, IP address hashes (not raw IPs), browser user agent, device type, timestamps, and optional embedded data from panel URLs (for example, a respondent ID or source ID). We do not collect names, email addresses, or direct identifiers unless a client explicitly includes them as survey questions.
How long is data retained?
Data is retained for the duration of the study plus a client-configurable retention period. Data deletion is available on request, and Supabase backups follow the configured retention window.
Can individual respondent data be deleted on request?
Yes. Respondent records, answers, page events, quality flags, and all associated data can be purged per individual respondent or in bulk per study.
Do you have a Data Processing Agreement (DPA)?
Yes. Supabase provides GDPR-compliant DPAs, and BEYOND Insights can execute DPAs with clients covering our role as data processor for survey research data.
Do you process data under CCPA and CPRA?
The platform supports CCPA compliance. We do not sell personal information, and respondent data is processed solely for market research purposes as defined in the study scope.
Network security
Is a Web Application Firewall (WAF) in place?
Vercel provides DDoS protection and rate limiting at the edge, Supabase includes built-in rate limiting on API endpoints, and application-level rate limiting is implemented per panel source.
Are there network segmentation controls?
Yes. The database is not directly accessible from the internet; all access goes through the Supabase API layer, which enforces Row-Level Security policies. Admin and respondent API endpoints are logically separated.
How are API endpoints protected?
Admin endpoints require authenticated session cookies with role validation, and survey endpoints require valid session tokens. Rate limiting prevents abuse, and input validation and sanitization are applied on all endpoints.
Vulnerability and patch management
How are vulnerabilities managed?
Dependencies are monitored for known vulnerabilities, and security patches are applied promptly. Application code undergoes regular review for OWASP Top 10 vulnerabilities.
Is there protection against common web attacks?
Yes. Protection includes XSS (input sanitization, React escaping, Content Security Policy), SQL injection (parameterized queries via Supabase), CSRF (Origin header validation), clickjacking (X-Frame-Options), and session fixation (server-generated tokens).
Subprocessors
What third-party services and subprocessors do you use?
Supabase (database, storage, authentication), Vercel (hosting, CDN, serverless compute), Anthropic Claude (optional AI-powered text analytics; data is not stored by Anthropic), and Sentry (error monitoring). Error reports are scrubbed before they are sent: request bodies, query strings, cookies, headers and user identity are removed, so they carry the exception and the route but no respondent answers or identifiers. No respondent data is shared with advertising or analytics services.
Do you run advertising or analytics tracking on your own sites?
Our public marketing pages run a LinkedIn Insight Tag for advertising measurement. It never runs on the admin application, on any survey, or on any respondent-facing surface, and it is covered by an automated test that asserts both its presence on the marketing pages and its absence everywhere else.
Do subprocessors have access to client data?
Supabase hosts the database and has technical access per their DPA. Vercel processes API requests in transit. Anthropic Claude processes open-end text only when explicitly invoked by the admin user, under Anthropic's data usage policy (no training on API data).
How are subprocessors vetted?
All subprocessors maintain SOC 2 Type II certification. Supabase and Vercel are established enterprise infrastructure providers with published security practices and available data processing agreements.
Business continuity and disaster recovery
What happens if your primary service goes down?
Vercel's serverless architecture automatically routes around failures, and Supabase provides automatic failover on the Pro tier. Survey data is persisted on every page save, so respondents can resume after any interruption.
Is there a disaster recovery plan?
Yes. Supabase provides automated daily backups with point-in-time recovery (PITR). The application is stateless (serverless), so infrastructure recovers automatically, and the database can be restored to any point within the retention window.
How quickly can you recover from a data loss event?
Point-in-time recovery allows restoration to any point within the retention window. The recovery point objective is near-zero for committed transactions, and the recovery time objective is minutes for a database restore and seconds for application redeployment.
What is your uptime commitment?
Supabase Pro provides a 99.9% uptime SLA for the database, and Vercel provides 99.99% uptime for the edge network and CDN. Application availability depends on both services.
Can data be exported if the platform is discontinued?
Yes. Full data export is available in XLSX, CSV, and JSON formats at any time via the admin platform, and raw database access is available via the Supabase dashboard for bulk extraction.
Have a security questionnaire of your own, or need provider reports under NDA? We are happy to walk your team through the detail.