Data Security & Privacy
How empiri protects respondent data and what it stores. The technical descriptions below reflect the platform's actual data-handling posture; the surrounding legal wording is placeholder pending review.
Draft — pending legal review
Roles
The organization running a survey is the controller of the responses it collects; the operator hosts and processes that data on the controller's behalf. Placeholder wording pending legal review.
Encryption at rest
All respondent data — answer payloads and any participant contact details — is encrypted in the database using application-level AES-256-GCM envelope encryption: a master key wraps a separate data-encryption key generated per survey. Deleting a survey destroys its key, which cryptographically shreds its responses. The database process and its dumps never see plaintext respondent content.
Respondent metadata
Capture of IP address, user agent, and device is opt-in on a per-survey basis and each is individually configurable. A survey can be run fully anonymous, in which case no such metadata is captured anywhere — including logs. When enabled, this metadata is itself encrypted with the survey's key.
Cookies
empiri uses two functional cookies and no tracking cookies: a session cookie for signed-in account holders, and a respondent survey cookie set on first visit to a survey so answers can autosave and resume. The respondent cookie is signed, httpOnly, and host-only, and is not used to identify people across surveys.
No third-party requests
The application makes no requests to third-party services from your browser: fonts are self-hosted and there are no analytics or advertising scripts. Nothing about a respondent is shared with an external service.
Backups
Backups are encrypted. The encryption key is stored separately from the database dumps, so a backup is useless for response content without the key. Placeholder wording pending legal review.
Hosting location
The service is hosted in Germany (Hetzner Online GmbH, Nuremberg data centre); the operating entity is based in Switzerland. Confirm the exact data-centre and any sub-processors before public launch.
Your rights
Depending on applicable law, respondents may have rights to access, correct, or delete their data. Requests are handled by the controlling organization; this placeholder must be completed with the operator's data-protection contact and process.