Security
Where your data lives, and who can access it.
Information for researchers, ethics committees, and procurement teams. Contact us if your review needs more detail.
Where data lives
Surveys and responses are stored in PostgreSQL. Uploaded files are stored in Supabase Storage. Both are hosted on AWS in us-east-2 (Ohio, United States). Backups are taken daily by the hosting provider. The application itself runs on Netlify’s edge network; static pages are cached globally, but response data is only ever persisted in the database region above.
Encryption
All traffic is encrypted in transit with TLS (HSTS is enforced site-wide). Data is encrypted at rest by the database and storage provider (AES-256). Card details never touch our servers — payment is handled entirely by Stripe, a PCI DSS Level 1 provider.
How access is controlled
The database denies access by default: every table is protected by row-level security, and workspace members can only reach rows belonging to their own workspace. Public survey pages don't query tables at all — they go through a small set of purpose-built database functions that expose exactly what a respondent needs and nothing else. Passwords and sessions are handled by Supabase Auth; we never see or store plaintext passwords.
Respondents are not tracked
Survey pages (/s/…) load no third-party scripts: no analytics, no ad pixels, no fingerprinting, no cookies beyond what’s strictly needed to run the survey (the optional one-response-per-browser marker, which is a random token, not an identifier, and on surveys that randomize, a cookie that keeps the same question order and experiment group through a reload). Respondents never need an account. The only third-party content is what a survey author adds: a YouTube, Vimeo or Loom video in a question loads that provider’s player, and an image linked from another site loads from that site. Our marketing pages and the signed-in app use Google Analytics to see which pages and buttons lead to sign-ups; survey pages, draft previews and shared results pages deliberately do not load it. What it receives is page views and named actions (a button pressed, a survey published): never an email address, a survey title, a question or an answer. On the Free plan, a finished survey sends the respondent on to plumeform.com, where Google Analytics does run; Pro surveys stay on their own closing screen.
One exception is switched on by the researcher, per survey: bot protection. While it is on, the survey page counts key presses, pointer activity, pastes into text answers and tab switches, and notes whether the browser reports being automated. These are counts only. It never records which keys were pressed or what was pasted, builds no device fingerprint, stores no IP address, and still loads nothing from a third party. The counts become review flags for the researcher; they never reject a response on their own.
Third parties (subprocessors)
Supabase provides the database, authentication, and file storage in AWS us-east-2. Netlify hosts the application, Stripe handles payments, and Resend sends transactional email. When you use an AI feature, Anthropic processes the relevant text, including response text when you request an open-text summary. Google Analytics runs on marketing pages and in the signed-in app, never on survey pages. Google Sheets, Slack and HubSpot receive response data only when a workspace connects a survey to them. Fonts are self-hosted.
Retention & deletion
Deleting a survey deletes its responses. Test-mode responses can be removed separately. Incomplete partial responses are deleted after 30 days, and support screenshots after 45 days. You can delete your account from Account & team. This cancels subscriptions immediately and permanently removes your login, owned workspaces, surveys, responses, and uploaded files. Cleanup failures are retried automatically. Other people's workspaces are preserved. Provider backups, security logs, Stripe transaction records, and exported copies follow separate retention policies, as explained in our privacy policy. For help, email from your account email address.
GDPR & international transfers
For survey data, the researcher is the data controller and Plumeform is a processor acting on instructions. We support access, export (CSV on every plan, XLSX on Pro; partial responses are not exported), rectification and erasure. Data is stored in the United States (AWS us-east-2); for EU/UK researchers, transfers are covered by our providers' standard contractual clauses and UK addendum — the same mechanism the major survey platforms rely on. A signed data processing agreement listing the subprocessors above is available on request from your account email. If a respondent contacts us about data in your survey, we'll route the request to you as controller.
Responsible disclosure
Found a vulnerability? Email with details and we'll respond within 48 hours. We ask for reasonable time to fix before public disclosure, and we credit reporters who want credit.
Certifications
Plumeform does not currently hold SOC 2 or ISO 27001 certification. If your security review requires more information about our controls or providers, contact us.
Last reviewed September 2026.