Platform Compliance & Security

Last Updated: June 2026

SurveyEngine is a professional survey and choice modelling platform used by universities, research organisations, government agencies, and commercial researchers worldwide.

This page provides information commonly requested during procurement, ethics review, information security review, and institutional purchasing processes for Non-Enterprise software subscriptions only (Free, Trial, Student and Standard), and designed to assist researchers managing their own compliance process with their institution. For Enterprise Licenses or project engagements contact SurveyEngine on info@surveyengine.com.

---

---

Security & Privacy

Hosting

SurveyEngine hosts customer data within Google Cloud managed infrastructure environments.
For all Subscriptions the physical location of all customer data is held in Germany. The physical location of customer data may, at the customer's request, be specified as :

• The United States
• Great Britain
• Australia
• Japan

Data Residency

Survey response data is stored and processed exclusively within SurveyEngine infrastructure hosted on Google Cloud Platform.

Survey response data is not shared with billing, CRM, marketing, forum, AI, or other third-party service providers.

Each customer maintains a separate response database.

Customer Account data, not response data, may exist across various account management systems listed below under subprocessors.

Customer data is not used for AI training

Encryption and Access Control

SurveyEngine implements security controls including:

• HTTPS/TLS encryption for data in transit
• Role-based access controls
• Authentication controls
• Administrative access restrictions
• Logging and monitoring processes
• Backup and recovery procedures

Subprocessors

SurveyEngine uses a limited number of third-party service providers ("subprocessors") to support the delivery and operation of the platform.

Subprocessor	Service Provided	Categories of Data Processed	Receives Survey Response Data
Google Cloud Platform	Application hosting, databases, storage, backup and infrastructure services	Survey responses, uploaded files, respondent metadata, customer account information	Yes
Stripe	Subscription billing and payment processing	Customer billing information, subscription records and transaction data	No
Google Workspace	Customer support, operational communications and account administration	Customer contact information and support correspondence	No*
HubSpot	Customer relationship management, onboarding, support ticket management and customer success activities	Customer contact information, support requests and account history	No*
Discourse	Community forum and user support platform	Forum account information, forum posts and community discussions	No*
Intruder	Security monitoring and vulnerability management	Technical infrastructure and security telemetry	No

* No routine processing of survey data. customer-submitted support materials may occasionally contain survey content provided voluntarily during support interactions.

SurveyEngine reviews all subprocessors through its supplier management and information security processes. New subprocessors will be assessed before being granted access to customer information.

Privacy

SurveyEngine operates under European Union data protection requirements and applies GDPR principles globally. Key principles include:

• Data minimisation
• Purpose limitation
• Privacy by design
• Secure processing
• Controlled access
• Defined retention procedures

---

Data Controller and Processor Responsibilities

For software subscriptions:

• The customer institution acts as Data Controller.
• SurveyEngine acts as a Data Processor providing survey software and support.

The customer determines:

• what data is collected
• legal basis for collection
• consent procedures
• retention requirements
• participant information provided to respondents

SurveyEngine provides the technical platform used to collect and manage data.

Additional information:
Privacy Policy
GDPR Compliance Information

---

Data Types Processed

SurveyEngine may process subscriber information including:

Account Information

• Name
• Email address
• Organisation
• Account preferences and usage
• Billing information

Survey Data

Determined entirely by the customer, which may include:

• Survey responses
• Experimental choice data
• Uploaded files
• Metadata collected by survey designers

Special Category Data

SurveyEngine does not require special category or sensitive personal data for operation of the platform.

If customers choose to collect sensitive information, responsibility for lawful collection and ethics approval remains with the customer institution.

---

Data Classification

SurveyEngine is designed to support:

• Public data
• Internal institutional data
• Research data
• Personal data

Customers are responsible for determining the classification level of the data they collect.

Highly sensitive or regulated datasets should be assessed by the customer under their own institutional policies before use.

Accessibility

SurveyEngine is committed to providing accessible software wherever practical. Accessibility considerations are incorporated into product design and ongoing development.

At present SurveyEngine does not maintain a formal VPAT. Institutions requiring accessibility information may request an accessibility statement describing current accessibility features and practices.

---

Common Procurement Questions

Question	Response
Is the Vendor GDPR compliant?	Yes
IS a Data Processing Agreement available?	Yes
Who is the Data Controller	Customer institution
Who is the Data Processor	SurveyEngine
Has a DPO been appointed	Yes
Is the EU privacy framework followed	Yes
Is a Security programme in place	Yes
Is the Vendor ISO 27001 compliance	Yes, (formal accreditation expected expected Q3 2026
HECVAT available?	Available upon request
VPAT available?	No formal VPAT currently maintained

---