Security you can
trust. Built in.

Your data is protected at every layer of RocketSurvey. We use industry-standard security practices, secure infrastructure, and transparent policies.

Read our privacy policy
RocketSurvey security shield with data encryption, secure infrastructure, SOC 2 Type II, secure storage, trusted cloud providers, and privacy by design
Diagram showing TLS 1.2+ in transit, AES-256 at rest, and PostgreSQL on Supabase

Your data, encrypted end-to-end

  • All traffic encrypted in transit via HTTPS (TLS)
  • Data encrypted at rest in our PostgreSQL database (Supabase)
  • Passwords never stored in plain text — hashed via Supabase Auth
Four cards: OAuth 2.0 + PKCE, Secure session, httpOnly cookies, Auto refresh

Secure sign-in

  • Industry-standard OAuth 2.0 with PKCE flow
  • Session tokens stored in secure, httpOnly cookies with auto-refresh
  • Built on Supabase Auth (used by thousands of production apps)
Network of user icons connected to a central lock, representing role-based access control

You control who sees what

  • Row-level database policies on surveys and responses — users can only access data they own or have been granted access to
  • Role-based workspaces: Admin, Editor, Viewer
  • Private, shared, or public survey visibility
Stripe checkout form with PCI DSS Level 1 badge and HMAC webhook verification

We never see your card

  • All payments processed by Stripe (PCI DSS Level 1 certified)
  • We store only a Stripe customer ID — no card numbers, CVVs, or payment tokens
  • Payment webhooks cryptographically verified via HMAC-SHA256
Three hosting features: Edge security, Reliable database, Built-in security

Enterprise-grade hosting

  • Hosted on Vercel's global edge network with built-in DDoS protection
  • Database managed by Supabase with automated backups
  • Automatic HTTPS, automatic security patching at the infrastructure layer
Laptop with lock and data control icons — export, delete, privacy, user controls

Your data is yours

  • Full account deletion with cascading cleanup — one click removes your account, surveys, responses, and billing data
  • GDPR-compliant data request and redaction flows for Shopify merchants
  • Privacy Policy and Terms of Use publicly available
  • Anonymous survey mode — collect responses without any PII
Network diagram showing third-party data processors: Supabase, Stripe, OpenAI, Vercel, Shopify, Resend, Google

Who touches your data

  • Supabase — database hosting and authentication
  • Stripe — payment processing (no card data stored by us)
  • OpenAI — AI analysis of survey responses
  • Vercel — hosting and content delivery
  • Shopify — merchant integration (for Shopify users)
  • Resend — transactional email
  • Google Places API — address autocomplete
SOC 2 Type II badge connected to infrastructure provider icons

Built on certified infrastructure

  • Built on SOC 2 Type II–certified infrastructure (Vercel, Supabase, Stripe)
  • Our hosting and payment providers are SOC 2 Type II certified
  • Runs on the same SOC 2–certified platforms used by Fortune 500 companies

Questions about security?

We're happy to answer anything — including responsible disclosure reports from security researchers.