Security
Security & EU hosting
The technical facts about where your data lives and how it's protected. We only state what's true today.
Where your data lives
- EU data residency. Survey data is stored on Supabase in eu-west-1 (AWS, Ireland).
- Norwegian company. SurveyBaker is operated by Rivenholt AS (org.nr 938 155 364), a Norwegian company.
- Our providers are not EU companies. Storing data in Ireland does not remove our providers from their own jurisdictions, and they can access data to run and support the service. Our privacy policy lists who processes your data.
How access is controlled
- Row-level security. The database enforces per-account access at the row level — not just in the app layer.
- Token-gated anonymous responses. Public response pages write only through narrow, token-checked database functions; they can't read or modify your other data.
- HTTPS everywhere. TLS with HSTS; strict content-security and framing headers.
In progress
Formal data-processing documentation (DPA, sub-processor list) is being prepared. This page will be updated when those documents are published — we won't claim them before they exist.