Security & Compliance

Convomint processes personal data in accordance with the General Data Protection Regulation (GDPR). For our Customers' employee data we act as a processor (Article 28 GDPR) — the employer remains the controller. Processing is governed by a data processing agreement, we collect only the data a survey needs, and we support Customers in fulfilling data subject rights: access, rectification, erasure and portability.

All traffic between the browser and the platform is encrypted with TLS, and browsers are instructed to use secure connections only (HSTS). Backups reach the backup store exclusively over encrypted connections. Particularly sensitive data — including personal survey and review links and integration keys — is stored encrypted in the database. Administrative access to production infrastructure requires cryptographic key authentication.

The platform and its database run in a data centre in the European Union (Germany), operated by a provider certified to ISO/IEC 27001. The database is not reachable from the internet — network rules allow connections from the application services only. Every application release is an immutable, versioned image that passes automated tests and security checks before deployment, and we can quickly roll back to the previous version if needed. Email notifications (review and survey invitations) are sent through a specialised EU email service with continuous deliverability monitoring: bounces are detected automatically, administrators see in the panel which messages were not delivered, and permanently unreachable addresses are blocked.

Access is role-based (administrator, HR, manager, employee) — each user sees only the data their role allows. Each organisation's data is isolated on several independent application layers. The platform supports two-factor authentication (MFA) and Google sign-in, and protects sign-in against password-guessing attempts. System events are recorded in central logs and monitored.

Database changes are archived continuously and a full backup is taken every day. Backups are kept for 30 days in a separate EU data store, outside the application server, with versioning that protects them from accidental or unauthorised deletion. This lets us restore data to a chosen point in time. We regularly test recovery by restoring the full database in a separate environment and comparing it with production.

Every code change passes automated tests, dependency scanning for known vulnerabilities and scanning for accidentally exposed passwords and keys — a change that fails these checks never reaches production. We also review code and configuration security following OWASP guidelines. Identified vulnerabilities are prioritised and fixed promptly.

We follow an established security incident response plan. We notify the Customer of a personal data breach without undue delay and provide the information needed to report it to the supervisory authority within the statutory 72 hours. Breaches affecting data for which we are the controller we report to the supervisory authority ourselves.

Our security practices follow OWASP guidelines and GDPR requirements. The data centre hosting the platform is certified to ISO/IEC 27001. On request, we complete Customers' vendor security questionnaires.

We keep data for the term of the agreement. After it ends, the Customer has 30 days to export results; the data is then deleted or anonymised, and backups expire automatically within the 30-day cycle. At the Customer's request we delete data earlier.

Users are responsible for the security of their accounts: using strong passwords and not sharing sign-in details with third parties. We recommend enabling two-factor authentication (MFA) for administrator accounts.

In anonymous surveys, we store answers separately from participation information. Employers see aggregated results, with safeguards for small groups. Anonymity has limits: an answer may reveal its author through its content, additional information or full access to the system. An IP address may be processed for security, but we do not store it with the answer. Older data may remain in backups.

We entrust data only to trusted subprocessors: infrastructure and hosting in the EU/EEA, transactional e-mail via Amazon SES (Amazon Web Services, EU region — Ireland), Stripe for payments, PostHog product analytics (EU cloud). AI features use external language-model providers under data processing agreements and standard contractual clauses — first and last names are automatically removed before data is sent to the models, and providers do not train their models on it. Full list and rules: Privacy Policy (sections 5–7).

The complete legal set for the Service: Terms of Service (including the right of withdrawal — §5), Privacy Policy, and Cookie Policy — all available in the Service footer. The data processing agreement (DPA) is available to Customers on request at [email protected].