Security
Security & EU hosting
The technical facts about where your data lives and how it's protected. We only state what's true today.
Where your data lives
- EU data residency. Survey data is stored on Supabase in eu-west-1 (AWS, Ireland).
- Norwegian company. SurveyBaker is operated by Rivenholt AS (org.nr 938 155 364), a Norwegian company.
- Our providers are not EU companies. Storing data in Ireland does not remove our providers from their own jurisdictions, and they can access data to run and support the service. Our privacy policy lists who processes your data.
How access is controlled
- Row-level security. The database enforces per-account access at the row level — not just in the app layer.
- Token-gated anonymous responses. Public response pages write only through narrow, token-checked database functions; they can't read or modify your other data.
- HTTPS everywhere. TLS with HSTS; strict content-security and framing headers.
Data-processing documentation
The data processing agreement is published and forms part of the service agreement; it names our sub-processors and gives you notice before one is added or replaced. The privacy policy lists who processes your data and on what basis. We state only what is published — no certifications are claimed.