View all our data security docs here.
-- -- --
Data Protection Officer
At OpinionX, we work hard to ensure that we fulfil the obligations of EU General Data Protection Regulation (GDPR) and maintain transparency about how we use customer and user data. We have a dedicated Data Protection Officer to oversee and advise on our data management. Get in touch through our messenger or by emailing [email protected].
-- -- --
Security Measures
Data is encrypted at rest using industry-standard AES-256 encryption, and all network traffic is encrypted using Transport Layer Security (TLS). OpinionX data is primarily hosted on Microsoft Azure and MongoDB Atlas (which runs on Azure) in the Republic of Ireland (Azure North Europe region). The database is deployed in an isolated virtual private cloud and is only accessible from granted IP addresses, not from the public internet. Some subprocessors process limited data in the United States; see our Approved Subprocessors list.
OpinionX maintains management-approved Risk Governance & Enterprise Risk Management (ERM), Asset Management, Acceptable Use, and Endpoint Security (BYOD) policies. These policies define risk ownership and a maintained risk register, are reviewed semi-annually, and are available to customers on request.
-- -- --
Security Questionnaire
1. Does OpinionX process (eg. store, transfer, modify, use, destroy) any customer data?
Yes, as a processor. OpinionX stores whatever survey and participant data each customer chooses to collect (from anonymous responses up to identifiable participant data, at the customer's discretion), plus team account details (such as name, email, hashed password, sign-in and security settings, and billing details for paid plans). All data is encrypted at rest and in transit, and primarily hosted in Ireland. We don't process customers' business or operational records. The full list of data categories is in Annex I of our Data Processing Agreement.
2. Does any OpinionX staff have access to customer data in clear text?
Yes, limited authorized staff can access survey and account data (eg. workspace members list, email addresses) to provide support and run the Services. Access is restricted to authorized personnel with legitimate business need, and access is logged.
3. Does OpinionX rely on Amazon (AWS), Google (GCP) or Microsoft (Azure) as sub-processors?
Yes, Microsoft Azure (Republic of Ireland).
4. Do any third parties (external to OpinionX, eg. business partners, sub-processors), other than those listed in the previous question process (eg. store, transfer, modify, use, destroy) customer data?
Yes, view our full list of Approved Subprocessors for more info.
5. Is multi-factor authentication mandatory for all OpinionX staff members and third parties (as from the previous question) who access user data?
Yes, 2FA is required on all third-party platforms used by OpinionX employees.
6. Is it possible for the customer to mandate multi-factor authentication for all its staff members who will use the service?
Yes, 2FA and SAML SSO are available to customers on the Accelerate tier.
7. Is customer data encrypted at rest and always encrypted in transit?
Yes, via AES-256 encryption at rest and TLS in transit.
8. Is customer data (including back-ups) hosted, processed or transferred outside of the EU?
Yes, for limited data. Core customer data, including the production database and its backups, is hosted in the Republic of Ireland. Some subprocessors process limited data in the United States: Intercom (support), Sentry (error monitoring and session replay), Microsoft Clarity (session recordings), Google (Analytics and Sign in with Google), Slack (internal alerts), Stripe (payments) and Cloudflare (script delivery). These transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. For more information, view our approved subprocessors list.
9. Does OpinionX outsource data hosting to a third party other than Amazon (AWS), Google (GCP) or Microsoft (Azure)?
Yes, to MongoDB Atlas, our database provider, which itself runs on Microsoft Azure in the Republic of Ireland.
10. Does OpinionX regularly back-up customer data? Are back-ups encrypted?
Yes to both. Backups are automated, encrypted, and retained for a maximum of 12 months.
11. Is OpinionX's RTO equal to or more than 4 hours?
Yes, OpinionX targets a Recovery Time Objective of 24 hours, ie. restoration of normal platform operations within 24 hours following a catastrophic outage. Routine failover events are typically resolved far faster.
12. Is OpinionX's RPO equal to or more than 1 day?
No, OpinionX targets a Recovery Point Objective of less than 1 day. Backups are automated, encrypted at rest, and verified periodically.
13. Is customer data stored in a multi-tenant set-up?
Yes, with logical separation between customers at the application and database layers.
14. Does OpinionX have a process to securely delete customer data at contract termination and upon request?
Yes
15. Are SLAs defined between OpinionX and the customer's organization for the scope of services covered?
Yes, available upon request.
16. Does OpinionX have formally defined criteria for notifying the customer in the event of an incident that might impact the security of our data or systems?
Yes
17. Can OpinionX provide the customer with a copy of access logs upon request (covering both customer staff and OpinionX staff)?
Yes
18. Is the ISMS related to the contracted services ISO 27001 certified?
No
19. Does OpinionX have a current SOC2 type 2 report covering the scope of contracted services?
No
20. Is OpinionX's platform independently security tested?
Yes. OpinionX commissions independent third-party penetration testing of the Services, and summary findings are available on request. Code changes also go through automated checks in our CI pipeline, including automated dependency updates and security scanning of our infrastructure configuration.
21. Does OpinionX maintain a formal risk management / ERM policy?
Yes, OpinionX maintains management-approved Risk Governance & Enterprise Risk Management, Asset Management, Acceptable Use, and Endpoint Security (BYOD) policies. Each has named ownership, is reviewed semi-annually, and is available to customers on request.
22. Does OpinionX use cookies or tracking on survey pages?
OpinionX does not set its own cookies on survey pages; survey progress is held in the browser's session storage. Google Analytics, Microsoft Clarity, and the Intercom Messenger (with the chat hidden) load on survey pages and set their own cookies. None is used for advertising. Full details are in Annex I of our Data Processing Agreement.