Security and privacy controls

The short version

SurveyLoopr uses HTTPS for data in transit, private access-controlled storage for uploaded research files, short-lived signed links for playback and downloads, and audit records for privacy decisions and identifiable-data disclosures. These are safeguards—not a certification or a promise that a study automatically satisfies a law or ethics requirement.

AI processing boundaries

• Audio transcription is blocked until a named project user records external-AI approval.
• The audio transfer occurs before privacy review, so privacy review cannot undo that initial transfer.
• Translation and analysis are blocked until the researcher acknowledges the transcript privacy review.
• Optional transcript review may send audio to an external processor again and is treated as a separate action.
• Provider names and model routing are recorded in the authenticated project audit/register; this public page describes categories rather than exposing operational credentials or architecture.

Audio and XLSForm data

Uploaded audio is stored in a private bucket and accessed through authenticated, time-limited links. Storage providers commonly apply encryption at rest, but HTTPS does not encrypt stored data against every server compromise or privileged-access scenario. SurveyLoopr does not currently promise customer-held, end-to-end encryption for audio because the transcription worker must be able to read the audio.

XLSForm workbooks are stored as workspace data. Do not place raw respondent data, private keys, or unnecessary identifiers in workbook cells or LooprAI prompts. Review generated questions, logic, settings, media, and sharing permissions before export or publication.

ODK form encryption

For sensitive ODK submissions, use form encryption in addition to HTTPS. Generate the keypair locally, give ODK Central only the public key, download and protect both key files during setup, and never upload or paste the private key into SurveyLoopr or LooprAI. The private key is your recovery secret: SurveyLoopr cannot recover it.

Backups, retention, and audit

Hosted servers are provisioned with automated daily backups and monitored for backup status. Failed backup controls trigger operator remediation; customers should still maintain independent exports appropriate to their recovery and compliance needs. Research projects can define a retention period so expired audio and derived research records are purged by the retention worker.

Privacy review summaries record how many potential issues were detected, how many the researcher kept hidden or restored, and the reviewing user ID. Audit records contain identifiers and counts, not transcript surface forms.

Provider disclosures

SurveyLoopr uses third-party infrastructure, storage, email, payment, and AI processing services. Before using a feature that transfers data, review the processor disclosures on your account page. Our subprocessor list and their data-retention terms are available on request for DPIA, DPA, and ethics review at [email protected]. Provider policies can change; customers should complete their own DPIA, transfer assessment, and ethics review for the countries and participants in their study.