Data retention policy
We store the following data:
- organizations and accounts - users of the service (including their email addresses)
- surveys along with questions and answers
- Stripe subscriptions
- Workspace details like name and domain
The data is stored unless we receive a specific request for data deletion according to GDPR - if this is the case the data is permanently deleted from the storage. The backups are done automatically by RDS and their retention is 7 days.
Data archiving and removal policy
For the time being we remove data after 5 years (unless we receive a specific request for data deletion according to GDPR - if this is the case the data is permanently deleted from the storage).
Data storage policy
The data is stored in a relational database (PostgreSQL) in AWS managed RDS. The data is encrypted at rest. The data is encrypted in transit using TLS. We use a separate Virtual Private Cloud (VPC) - we do not use a default VPC since its settings are not optimized for security but rather for ease of start. The VPC spans more than one Availability Zone (AZ) - in production, all resources are built-in Multi-AZ setup so the application can achieve high availability. The VPC is divided into public and private subnets and no unnecessary resources are exposed to the public Internet. The RDS database is placed in a private subnet and is accessible only from the application hosts. The application hosts are placed in a private subnet and are accessible only from load balancers placed in a public subnet. Apart from RDS-based encryption, the sensitive information (for example Slack tokens) is symetrically encrypted using a secret stored in an AWS Systems Manager Parameter Store.
Data center location(s)
Ireland
Data hosting details
AWS RDS PostgreSQL
App/service has sub-processors
yes
Guidelines for sub-processors