Security

What this page is for

Buyers often ask the same hosting and isolation questions. This page states the controls we actually have. It is not a certification, an audit report, or an SLA.

Hosting and data location

The application is hosted on Vercel. Workspace data lives in Supabase-hosted Postgres in the United States (us-east-1). The product is operated from the United States.

Encryption

Traffic is encrypted in transit with TLS. Supabase encrypts data at rest with AES-256. Passwords are stored hashed, not in plaintext. Sessions use cookies.

Tenant isolation

Every workspace record is tagged with a tenant identifier. Row-level security (RLS) in Postgres is designed so one firm's data is not visible to another firm. Trying to bypass that isolation is a violation of the Terms.

Access to customer data

Support may access a tenant only when the customer asks. We do not keep standing access to customer project or field data for browsing. Account owners remain responsible for who they invite into the workspace.

Error reporting

We use Sentry to capture application errors so we can fix bugs. Our Sentry configuration is set not to send default personal information. We strip email addresses, tokens, and user objects from events before they are sent.

What we do not claim

Survey Forward itself is not SOC 2 certified, not ISO 27001 certified, not HIPAA certified, and not PCI certified. We have not completed an independent application penetration test. We do not publish uptime SLAs, backup RPO/RTO numbers, insurance limits, or employee counts on this page. If a questionnaire asks for those, the honest answer is that we do not have them yet.

What Supabase publishes about itself

Supabase hosts our database, authentication, and file storage. Supabase publicly states that it is SOC 2 Type 2 compliant, ISO 27001 certified, and that it hires third parties to pen-test its own platform. Those statements are Supabase's, not Survey Forward's. See supabase.com/security. We do not inherit those badges as our own.

What we do not do with data

• We do not sell customer data.
• We do not train AI models on customer data.
• We do not put advertising pixels in the app.

Incidents

If we confirm a breach of customer data, we will notify affected customers without unreasonable delay, consistent with the time needed to understand the scope and with any lawful request by law enforcement to delay notice. South Carolina's breach-notice statute (S.C. Code § 39-1-90) uses that same “without unreasonable delay” standard for qualifying personal information of South Carolina residents.

Vulnerability reports

Email hello@surveyforward.com with the subject line SECURITY. Please include enough detail for us to reproduce the issue. Do not access other tenants' data while testing.

Data processing addendum

A DPA is available on request. Email hello@surveyforward.com. We do not publish DPA contract text on this site.

Vendors

The companies that help us run the product are listed on Subprocessors.

Contact

Survey Forward, LLC · Charleston, South Carolina
hello@surveyforward.com