Detailed BCPs are available to customers on the Accelerate tier or higher. Otherwise, the summarized version below applies to all other users with an OpinionX account. View all our data security docs here.
Last Review Date: 03 November 2026
This document outlines the approach we take at OpinionX to ensure platform availability, safeguard data, and maintain business resilience during disruptions.
-- -- --
1. Scope & Objectives
This document covers:
Core OpinionX services, including user login, survey access, and data access.
Protection of customer data (refer to our Data Processing Agreement for data processing terms).
Clear, proactive communication with customers in case of disruption.
Key objectives:
Ensure service uptime through redundancy and fault-tolerant architecture.
Protect customer data through encryption and secure backup practices.
Restore services rapidly, minimizing downtime.
Maintain transparent customer communication, including incident notifications and access log disclosures when needed.
-- -- --
2. Infrastructure & Hosting
Hosted on Microsoft Azure, with our primary database on MongoDB Atlas (which also runs on Azure), both in the Republic of Ireland (Azure North Europe region).
The database runs as a replicated cluster across multiple availability zones for resilience.
All network traffic is secured via TLS, and data is encrypted at rest with AES-256.
The database is not accessible from the public internet; access is restricted to authorized IP addresses only. Public-facing services (the web app and API) are served over HTTPS only.
-- -- --
3. Backup & Recovery
Databases are backed up automatically. Backups are encrypted at rest, stored in the Republic of Ireland with access controls, retained for up to 12 months, and verified periodically.
Recovery Time Objective: OpinionX aims to restore normal platform operations within 24 hours following a catastrophic outage. Enterprise SLAs contain specific time-bound goals.
Recovery Point Objective: OpinionX targets an RPO of less than 1 day. Enterprise SLAs contain specific time-bound goals.
-- -- --
4. Security & Access
Survey and participant data that customers choose to collect is stored and processed by OpinionX as a data processor, encrypted at rest (AES-256) and in transit (TLS), and primarily hosted in the Republic of Ireland.
Access to production data is restricted to authorized personnel with a legitimate business need, protected by mandatory MFA.
-- -- --
5. Incident Response & Communication
Full incident response protocols are defined, including:
Immediate containment of malicious or performance-affecting incidents.
Triage and forensic investigation to determine root causes.
Restoration of affected services following backup and failover procedures.
Notification triggers are established: whenever an incident impacts system availability or security, customers will be alerted via email in line with GDPR and contractual transparency obligations. Personal data breaches are notified within 72 hours, as set out in Section 7 of our Data Processing Agreement.
Access logs, covering both customer and internal accesses, are securely stored and available upon request.
-- -- --
6. Subprocessors & Dependencies
We engage only a limited set of subprocessors, all committed to secure operations, encryption, and access controls.
All subprocessors are listed in our Approved Subprocessors register.
Each operates under contract and GDPR-compliant data protection terms.
Data transfers outside the EEA rely on the EU–US Data Privacy Framework or Standard Contractual Clauses, as set out in Section 11 of our Data Processing Agreement.
-- -- --
7. Support & Escalation
Platform support is accessible via live chat or email ([email protected]).
Our Data Protection Officer oversees data handling queries ([email protected]).
SLAs and custom DPA options are available for customers subscribed to the Accelerate Tier or higher.
-- -- --
8. Plan Review & Testing
Our detailed BCP is reviewed annually and after any incident.
Backups and recovery routines are tested 2x per year to ensure effectiveness.
Process improvements are implemented based on test outcomes and incident analyses.
-- -- --
9. Tiered Disclosure
Enterprise-grade assurances like signed SLAs, formal DPAs, or detailed recovery metrics are available upon request to customers on the Accelerate Tier or higher.