Security

Encryption

Data is encrypted in transit over TLS, and at rest in two layers: volume encryption on the server, and an application layer that encrypts the response answers themselves before they are stored. Answers are only ever decrypted in the scoped paths that need them, such as your Results view and CSV export.

Isolation

Every query is scoped to a single workspace through one enforced chokepoint, so one workspace can never read another’s data. The database is never exposed to the public internet.