Snapshot 132866
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Home Survey best practices SurveyMonkey Trust Center Trust Center With enterprise-grade security, compliance, and privacy controls, we protect your data like it's our own—just like we do for 260K+ organizations worldwide. Security | Privacy | Certifications | AI | FAQs | Contact sales BENEFITS Manage your data and keep it safe with SurveyMonkey ✔ Dedicated security team ✔ Annual third-party penetration tests ✔ Bi-annual privacy and security reviews ✔ 24/7 on-call security Incident response team ✔ Encryption at rest (AES-256) and in motion (TLS 1.2) ✔ Active bug bounty program ✔ AWS cloud security ✔ Annual security awareness programs for all employees and contractors ✔ Annual exec-level tabletop exercises ✔ Privacy by design ✔ Bi-annual audit for privacy compliance ✔ Data breach notification ✔ Customer control of data ✔ AI governance ✔ Standard Contractual Clauses (SCCs) by default ✔ Data Privacy Framework (DPF) self-certified ✔ Robust privacy impact assessment processes ✔ SOC 2 Type II ✔ ISO-27001 ✔ ISO-27701 ✔ CCPA ✔ HIPAA** ✔ PCI DSS ✔ GDPR (EU, UK, Switzerland) **BAAs available as add-on with the Enterprise plan; must be purchased separately ✔ Single Sign-On (SSO)* ✔ Two-factor authentication (2FA) ✔ Account control* ✔ Data deletion on a self-service basis or upon request *Available to SurveyMonkey Enterprise only SECURITY Protect your data with best-in-class security You need a survey platform you can trust with your sensitive data. That’s why SurveyMonkey delivers a comprehensive security program that safeguards your data at every level—from secure product development and employee training to robust global infrastructure management. We undergo regular third-party audits and security reviews to stay ahead of potential threats, ensuring your data remains protected at all times. Enterprise security features Security-first product development We take a security-first approach to building and maintaining our platform. Every product developer is trained in secure web application development practices when hired and completes annual refresher trainings to stay up to date on best practices. 24/7 monitoring and rapid response Security threats don’t keep business hours, and neither do we. Our dedicated incident response team operates 24/7, conducting annual independent penetration tests and running a bug bounty program to proactively identify and address vulnerabilities. Enterprise-grade encryption and secure cloud storage We protect your data with AES-256 encryption at rest and TLS 1.2+ encryption in transit. Customer data is securely stored on AWS servers in the US, Canada, and Ireland (EU), ensuring compliance with regional data protection standards. PRIVACY Built-in privacy features for peace of mind SurveyMonkey is built with privacy at its core, so you can collect insights with confidence. Our platform includes built-in features to help you meet GDPR (EU, UK, and Switzerland) and CCPA requirements effortlessly. We stay ahead of evolving regulations with ongoing updates, so your data continuously remains protected and compliant. Learn more Secure international data transfers We are self-certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF Principles, ensuring strict adherence to privacy standards for cross-border data transfers. We also embed Standard Contractual Clauses (SCCs) in our customer and vendor contracts. See our Transfer Statement for more details. Regional cloud storage options Our AWS-based data centers in Ireland (EU), Canada, and the US give Enterprise users control over where their data is stored. No matter the location, our privacy and security settings ensure compliance with data protection regulations in regions such as Australia, Canada, the UK, Switzerland, and the EU. Control over your data We provide flexible data retention and deletion controls that align with your local regulatory requirements. With SurveyMonkey, you get strong privacy defaults, intuitive controls, and the flexibility to manage your data on your terms. CERTIFICATIONS & STANDARDS Simplify how you stay compliant With certifications like SOC 2, PCI, ISO 27001, ISO 27701 and periodic privacy audits, SurveyMonkey has independent third parties assess key aspects of our security and privacy programs. These external assessments measures our programs against industry-recognized standards, and we continue to work to protect your data. Download GDPR white paper Industry-specific compliance features All SurveyMonkey plans include PCI DSS certification. Enterprise customers can also opt for HIPAA compliance or our Enhanced Sensitive Data Protection. Comprehensive third-party audits SurveyMonkey has been ISO 27001-certified since 2019, and SOC 2-certified since 2021. We undergo annual audits to ensure that our security controls are consistently met and continuously improved. Dedicated Data Protection Officer (DPO) To ensure ongoing compliance and privacy maturity, we have an internal Dedicated Data Protection Officer (DPO) and work with an auditor to ensure we’re meeting GDPR requirements and adhere to industry best practices. RESPONSIBLE AI Leverage product capabilities rooted in responsible and trustworthy AI We built innovation and security into our AI capabilities, so you can benefit from the power of AI without compromising your data. Our partnerships with third-party providers ensure your data is never used to train their models, keeping your information safe, private, and fully in your control. Learn more “SurveyMonkey checked off two buy-in factors: SurveyMonkey understands GDPR. SurveyMonkey gets Salesforce. That’s huge for us.” Matt Schoolfield Senior Manager of Commercial Analytics and Voice of the Customer Greyhound Explore more security and privacy resources Legal Center Find information on privacy, security, terms of use, and other important legal topics. Learn more Privacy white paper See how we prioritize compliance and protect your data. Download now Security white paper Get an in-depth look at how we safeguard your data with industry-leading security practices. Download now FAQs Is it safe to use SurveyMonkey? Is SurveyMonkey GDPR compliant? Where does SurveyMonkey store data? Can I use SurveyMonkey to collect protected health information (PHI)? Can I use SurveyMonkey to collect sensitive data? Is my data used to train AI models? How does SurveyMonkey encrypt data? Does SurveyMonkey undergo an external penetration test? What security certifications does SurveyMonkey have and maintain? How do I fulfill Data Subject Requests (DSRs?) Do you sell my data or my respondents’ data? What third-party vendors have access to my data? Does SurveyMonkey have processes in place to ensure continuous compliance with local and international privacy and security regulations? Which transfer mechanisms do you rely on when data crosses borders? Does SurveyMonkey comply with the Australian Privacy Act to include recent reforms? Want to learn more? Contact our sales team and get all your security and privacy questions answered, plus access to specific resources. Note that certain documents may require an NDA on file.