SECURITY
Where your data lives, and who can touch it.
Written for the people who have to ask: researchers, IRBs, and procurement. If a question isn't answered here, email us and it will be.
Where data lives
All application data — surveys, responses, uploads — is stored in a dedicated PostgreSQL database hosted by Supabase on AWS in us-east-2 (Ohio, United States). Backups are taken daily by the hosting provider. The application itself runs on Netlify's edge network; static pages are cached globally, but response data is only ever persisted in the database region above.
Encryption
All traffic is encrypted in transit with TLS (HSTS is enforced site-wide). Data is encrypted at rest by the database and storage provider (AES-256). Card details never touch our servers — payment is handled entirely by Stripe, a PCI DSS Level 1 provider.
How access is controlled
The database denies access by default: every table is protected by row-level security, and workspace members can only reach rows belonging to their own workspace. Public survey pages don't query tables at all — they go through a small set of purpose-built database functions that expose exactly what a respondent needs and nothing else. Passwords and sessions are handled by Supabase Auth; we never see or store plaintext passwords.
Respondents are not tracked
Survey pages (/s/…) load no third-party scripts: no analytics, no ad pixels, no fingerprinting, no cookies beyond what's strictly needed to run the survey (and the optional one-response-per-browser marker, which is a random token, not an identifier). Respondents never need an account. Our marketing pages use Google Analytics; our survey pages deliberately do not.
Third parties (subprocessors)
Supabase (database, auth, file storage — AWS us-east-2) · Netlify (hosting and edge network) · Stripe (payments) · Resend (transactional email) · Anthropic (AI drafting/import/translation — only the survey text you explicitly submit to an AI feature is sent, never response data) · Google (analytics on marketing pages only; Sheets sync only for workspaces that connect it). Fonts are self-hosted — no requests to font CDNs.
Retention & deletion
Response data stays until you delete it — deleting a survey deletes its responses, and test-mode responses can be purged with one click. Incomplete partial responses are automatically deleted after 30 days. Screenshots attached to support messages are deleted after 45 days. Workspace deletion (everything, permanently) is available by request from your account email to hello@plumeform.com and is completed within 30 days.
GDPR
For survey data, the researcher is the data controller and Plumeform is a processor acting on instructions. We support access, export (CSV/XLSX of everything), rectification and erasure. A signed data processing agreement listing the subprocessors above is available on request. If a respondent contacts us about data in your survey, we'll route the request to you as controller.
Responsible disclosure
Found a vulnerability? Email hello@plumeform.com with details and we'll respond within 48 hours. We ask for reasonable time to fix before public disclosure, and we credit reporters who want credit.
Honest scope
Plumeform is an independent product, not an enterprise suite with a compliance department: we don't currently hold SOC 2 or ISO 27001 certification. What we do have is a deliberately small attack surface, default-deny data access, no tracking on participant pages, and a founder who answers security email personally. If your review needs something specific answered, ask — you'll get a real answer quickly.
Last reviewed July 2026.