SECURITY & DATA PROTECTION
Security & data protection at OpinionX
How OpinionX protects your company’s and your participants' data, with the controls your security team checks for and the documents your reviewers ask for, in one place.
Certifications & Compliance
Where we stand today.
GDPR
● CompliantBuilt to GDPR, with the Irish Data Protection Commission as supervisory authority. Custom DPA available on request.
SSO & MFA
● LiveSAML single sign-on with any major provider, plus multi-factor authentication available on the Accelerate tier.
SOC 2
● In progressSOC 2 Type 1 examination in progress. Ask us where it's at for the latest update.
Insurance
● Covered€1.3M professional indemnity and €1.3M cyber liability cover. Certificate of insurance available upon request.
How your data is handled
Encryption
Data is encrypted in transit with TLS and at rest with AES-256, across both the production database and every stored backup.
Hosting
Hosted on ISO 27001 and SOC 2 certified infrastructure, Microsoft Azure and MongoDB Atlas, in data centres in Ireland.
Access control
Least-privilege access with MFA across systems. The production database is network-isolated and IP allow-listed, reachable only by authorised staff bound by confidentiality.
Authentication
SAML single sign-on that syncs with any major identity provider, plus two-factor authentication available on every workspace.
Backups
Encrypted backups are stored in Ireland with defined recovery objectives, backed by a documented business continuity plan we can share.
Data deletion
Delete survey and participant data on request, through a documented deletion process. Data-subject requests are handled in line with GDPR.
Testing
Independent third-party penetration testing on a periodic basis, plus automated vulnerability scanning and ongoing patching of the platform.
Incident response
A documented process spanning detection, containment, investigation, recovery and notification. Customers are notified of a personal-data breach within 72 hours of us becoming aware.
Security program
A documented information security program covering risk governance, secure development, change management and more. Full documentation on request under NDA.
Privacy & data protection
Data Processing Agreement
Standard DPA available on request for any customer processing personal data.
Data Processing Agreement
Subprocessors
The third-party services we use to run OpinionX, listed and kept current.
Approved Subprocessors
Data-subject requests
How participants and customers exercise their access, correction and deletion rights.
Privacy Policy · Data Collection and Management
International transfers
Covered by the EU-US Data Privacy Framework and Standard Contractual Clauses. UK GDPR and Swiss FADP where they apply.
Security documents
What your reviewers need, without waiting on us.
Need a DPA, our subprocessor list, or help with a security questionnaire? Contact us and we'll get it to you. For the full security package (including internal policies, DPA and penetration-test summary), contact us to request it under NDA.
Questions your reviewers can't answer from the page?
Our team answers security and compliance questions directly.