Sub-processors

Neon

• Data processed: All platform data including account information, survey configurations, survey responses, and operational metadata
• Retention: As directed by Surventrics; Neon acts strictly as infrastructure provider
• Certifications: SOC 2 Type II

Clerk

• Data processed: Account credentials (email, password hashes), session tokens, login history (timestamps, IP addresses, device information), multi-factor authentication records
• Retention: As configured by Surventrics; session data subject to Clerk's expiry policies
• Certifications: SOC 2 Type II

Vercel

• Data processed: HTTP request and response data, edge logs, serverless function execution data
• Retention: Edge logs retained per Vercel's standard retention policy (typically 30 days)
• Certifications: SOC 2 Type II, ISO 27001

Cloudflare

• Data processed: Files uploaded by survey creators — images, media assets, and survey attachments
• Retention: As directed by Surventrics; Cloudflare acts strictly as infrastructure provider
• Certifications: SOC 2 Type II, ISO 27001, PCI DSS

Cloudflare Stream

• Data processed: Videos uploaded by survey creators, plus the internal organisation, user and survey IDs attached to each upload as metadata (no names or email addresses)
• Retention: As directed by Surventrics; Cloudflare acts strictly as infrastructure provider
• Certifications: SOC 2 Type II, ISO 27001, PCI DSS

AI processing provider

• Data processed: Question text and response text. Personally identifiable information is scrubbed before any data is transmitted.
• Retention: Not used to train models. Deleted by the provider within 30 days under its standard API terms, and kept longer only where needed to enforce its usage policy or required by law.
• Certifications: SOC 2 Type II

The specific provider is named to customers under NDA on request. We may change AI provider subject to the notice period below. Under its terms, every provider we engage may not train models on the data and ordinarily deletes it within 30 days (see Retention above).

Stripe

• Data processed: Payment card details, billing addresses, invoice records, transaction history, subscription plan details
• Retention: As required by financial regulation; minimum seven years for transaction records
• Certifications: PCI DSS Level 1, SOC 2 Type II, ISO 27001

Resend

• Data processed: Recipient email addresses, sender details, email content, delivery metadata (delivery, bounce and complaint status)
• Retention: Delivery logs retained per Resend's standard retention policy
• Certifications: SOC 2 Type II

Sentry

• Data processed: Error reports from our servers and from browsers, survey pages included: the error type, message and stack trace, the page or request path (no query parameters), and a short allow-list of request and response headers that carry no credentials or personal data (content type and length, accept and language, host, user agent, request ID), plus the internal identifiers our code attaches as context (request, user and organisation IDs), with email addresses and credentials redacted. Not collected by the SDK: user details or IP addresses, cookies, HTTP request or response bodies, AI prompts and outputs, database query data, queue payloads. Performance traces are off by default.
• Retention: [PLACEHOLDER]
• Certifications: [PLACEHOLDER]