Vurvey

Security isn't a single yes/no, but Vurvey is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Vurvey hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@vurvey.com or via a /security page (Vurvey lists a security contact).

Vurvey lists 15 subprocessors on its trust center, including Google Cloud Platform, Cloudflare, Brightcove (Zencoder), Sendgrid, Intercom. Buyers use this for fourth-party risk review.

Vurvey hosts on GCP, and handles Customer personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Vurvey's trust center is at https://trust.vurvey.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

At Vurvey, we define Personally Identifiable Information as information that can uniquely identify an end user or a combination of information that could reasonably identify a single end user. Vurvey may process the following information: (1) email, first and last name; (2) Demographic including ethnicity, gender and age; (3) IP Address

Vurvey is a SaaS platform for collecting survey responses from end consumers and viewing the responses. The application is accessed via secure login from a web browser located at a secure URL (vurvey.app). The Vurvey platform utilizes Google Cloud Platform (GCP) to store and process customer data. All data processing activities include data encryption for in-transit using Transport Layer Security (TLS/HTTPS) and at rest using the AES-256 algorithm.

Vurvey has implemented a Privacy by Design model where there is minimal handling and storage of PII built into our product design. We continually refine the concepts of redaction, reduction, and transparency as our technology evolves.

Your data is never used to train AI models. Vurvey's Responsible AI principles include: - We use caution with confidential customer information in AI tools, avoiding submission of sensitive data unless a) explicitly authorized and/or b) we have platform assurances that such data will not be used for training publicly available Large Language Models (LLMs.) - We do not fine-tune large language models. Fine-tuning alters the parameters and weights of an existing model by supplying labeled data. This has the potential to weaken built-in safety measures as well as leak sensitive data. - We anonymize all users by generating pseudo-identifiers. Personally identifiable information for users is never shared with the large language model. - We rigorously test and validate underlying algorithms that service AI models to identify and address potential issues before deployment. - We commit to complying with all customer agreements, policies, and directives in our AI deployments to the best of our ability and within the constraints of our systems and processes.