Security and privacy
Know where your members' data lives, and who can reach it.
Survizo keeps your community's data in the United States, encrypted, with its database backed up continuously. Our support team looks in only when you let them, and every visit is logged for you to read. Send this page to your security team. It answers the first questions they will ask.
The ground rules
Kept in the United States, apart from every other community.
Hosted in the United States, encrypted throughout
Your community's records, uploaded files, call recordings and members' sign-in accounts are all stored in the United States. The AI that writes your reports runs there too, and so do your live interview calls and their transcripts. Everything is encrypted while it travels and while it is stored, and our hosting provider looks after the encryption keys. The database is backed up continuously.
- Hosted in the United States
- Encrypted in transit and at rest
- Database backed up continuously
Each community stands alone
Every record belongs to one community. Each time anyone opens or saves something, our servers check that they signed in to that community. Nothing a person changes on their own computer gets round that check.
Each community's joining rules, sign-in pages, emails, features and look come only from its own settings, so nothing set for one shows up in another. The same email address in two communities means two separate accounts, each with its own password.
- Checked on our servers
- Two communities, two accounts
- Each keeps its own settings
Support access
Our support team comes in only when you let them.
You hold the switch on every admin account you create yourself. If our team creates an account for you instead, we look after it from day one, and its account screen says so.
You switch it on
Access stays off until an administrator with full rights on your side turns it on, for one account at a time. Your Account settings screen shows it for as long as it's on.
They state a reason
Our engineer types a reason for every look and every change. Access opens only once the reason is given, even if they only want to look.
They can do only a few things
They can view settings, members, surveys, responses, discussions and calls. They can change only three things. They can adjust a community's joining settings (open or not, approval, member limit), unblock a member, or reopen an expired invitation.
You see all of it
Every step shows up in the Activity by Survizo tab of your Audit screen, refused attempts included. Switch access off and it ends at once.
A worked example
Every support visit leaves a record you can read.
A made-up request, recorded exactly the way your Audit screen shows it.
What happens
New members are stuck waiting for approval. Please switch approval off for our community.
- Support access is on for the account that owns the community.
- The engineer opens the account and gives the reason.
- They look at the settings, then change one of them.
Activity by Survizo
| Action | Outcome | What changed |
|---|---|---|
| Opened your account in the support console | Allowed | None |
| Viewed your community settings | Allowed | None |
| Changed a community setting | Allowed | requiresApproval: true → false |
Each row also shows the staff account, the time and the reason given. A refused attempt appears the same way, marked Refused. The last row means approval for new members was switched off.
In detail
Each safeguard, from sign-in to deletion.
Sign-in and sessions
Administrators can turn on two-step sign-in in Account settings. You set it up with an authenticator app on your phone, and a backup key gets you back in if you lose the phone. From then on, every sign-in asks for your password and a code from the app, which is safer than a code sent by text.
Everyone who uses your admin screens, from your team to moderators and clients, is signed out after 24 hours without activity. Work in any open tab counts as activity, and the sign-in page tells you why you were signed out. Members stay signed in as usual. For tighter control, switch on a setting that keeps each account in a community to one device at a time.
- Authenticator app, not text messages
- Signed out after 24 idle hours
- One device at a time, if you choose
Recordings and files
Call recordings are stored privately inside their community, with no permanent link anyone could open. Only the community's owner, or a moderator you've given that right, can play one. Each play uses a fresh link that stops working after an hour, so a forwarded link soon goes dead.
When you delete a community, the files uploaded inside it go too, including images, attachments, call recordings and video answers.
- No direct access to recordings
- Playback links last an hour
- Files go with the community
What the AI reads
An AI report reads one community's own data. Before it reads a single answer, we confirm the person asking still has access, and we log every time answers are read, allowed or refused.
The AI never analyses private messages or the complaints members file, even though an administrator can read both to moderate the community. Call transcripts carry no names, and their speaker labels identify nobody. When a report quotes a call, the speaker becomes “a participant” before the report is saved.
- One community per report
- No private messages or complaints
- Reads of answers are logged
Safe connections to your other systems
Each key your other systems use belongs to one community and can do only what you allow. You see it once, when you create it, and we store only a scrambled copy that nobody can turn back into the key.
When you create a key, you choose whether it expires after 90 days, one year, or never. An expired key stops working straight away, and we cap how often any key can be used. The reference for your developers lists every request a key can make, with the permission it needs.
- One community per key
- Never stored readable
- 90 days, a year, or never
Backups and how long records are kept
Your community's records are backed up continuously, and if anything goes wrong our team can restore them to any second in the last 35 days.
Every night, Survizo clears out four kinds of housekeeping record once their time is up. We keep the audit trail for up to 365 days, email delivery records and notifications for up to 180 days, and expired invitations for up to 30 days. Research data is never on a timer. It stays until a member's data is erased or the community is deleted. The Data & retention tab of your Audit screen shows each period and when the last nightly clear-out ran.
- 35 days of backups
- Old records cleared nightly
- Research data never on a timer
Consent and members' own data
When someone agrees to join, we record the time and a unique fingerprint of the wording they saw, so you can prove later exactly what they agreed to. The record stays as it was, whatever is edited later, and an administrator can read it.
Members can download what their community holds about them. They can also ask for it to be erased, and they see first exactly what will be deleted, anonymised or kept. Members and consent walks you through both.
- A fingerprint of the exact wording
- A copy on request
- A preview before anything is erased
Your security review
Get your security questions answered on a fit call.
Members sign in with their email address and a password, or with their Google account if you switch that on for your community. If your security team has a questionnaire, bring it to a fit call and we'll answer it plainly.
At a glance
Security and privacy in six facts.
Each community stands alone
Every request is checked on our servers, and each community has its own accounts.
Support access is yours to grant
Off until you switch it on, and every look and change appears in your Audit screen.
Two-step sign-in
Administrators can add a code from an app, and your team is signed out after 24 idle hours.
Recordings behind a check
Only the owner, or a moderator you allow, can play them, through links that last an hour.
35 days of backups
Our team can restore your records to any second of the last 35 days.
Research kept, old records cleared
Housekeeping records are cleared every night. Research data is never on a timer.
Next up
Where to go from here.
Members and consent
Invite your own customers, and keep proof they agreed.
Invite your customers by email and WhatsApp, choose who joins, and keep a timed record of the exact wording each member agreed to.
Members and consentMany communities, one account
Every client, brand and market. One login, and no client ever sees another's community.
Run a community for every client, brand or market from one login. Each keeps its own address, members and settings, and clients see only what you grant.
Many communities, one accountThe next step
Book a fit call.
Thirty minutes with the people who build Survizo. Bring a study you have coming up. You'll leave knowing whether Survizo fits it and how soon you could launch.