Great Question
Certifications and attestations: SOC 2 Type IISOC 2 Type I
Says it complies with: GDPR
As listed on Great Question's trust center (evidence) ; reports themselves are usually shared on request.
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | not found | 0 / 12 |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | not found | 0 / 6 |
| Security page | 5 / 5 | |
| Status page | not found | 0 / 5 |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 72 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For Great Question's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/great-question"><img src="https://thirdpartyindex.com/badge/great-question.svg" alt="Great Question transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/great-question)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center vanta | snapshot | ||
| Subprocessor list vanta | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| Security page | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Adobe | Extracts text and content from uploaded PDF files.; PDF content extraction | United States | |
| Algolia | Powers in-app search. Holds a search index of candidate names and previous research data, kept in sync with the platform and removed when the source data is deleted.; Search infrastructure | United States | |
| Amazon Web Services | Hosts the Great Question platform. Stores the production database (RDS) and file uploads, images and CSV imports (S3) for the life of the customer account.; IaaS Provider: File storage (S3) + RDS | United States | |
| Anthropic | LLM inference; LLM inference for AI features. | United States | |
| Cartesia | Text to Speech Services; Text-to-speech for AI-moderated sessions. | United States | |
| Daily.co | Video calls, screen sharing and recording for research sessions. Processes candidate video recordings.; Video recording and screen sharing | United States | |
| Datadog | Infrastructure monitoring, log storage and APM. No PII is sent; identifiers are scrubbed before ingestion. Logs are retained for a limited period for troubleshooting.; Monitoring and logging | United States | |
| Deepgram | Transcribes audio from research sessions to text.; Transcription | United States | |
| Frigade | In-app onboarding; In-app onboarding flows and product tours. Retains onboarding progress per user. | United States | |
| Google Analytics | Website traffic analytics; Website traffic analytics for the marketing site. IP addresses are anonymized; aggregate visitor data is retained for reporting. | United States | |
| Google Cloud | AI embeddings provider (Ask AI semantic search); Generates vector embeddings via Vertex AI for Ask AI semantic search and transcript indexing. Processes transcript text and user-entered Ask AI queries, which may include PII. | United States | |
| Hubspot | Sales and marketing CRM. Retains prospect contact information for the duration of the sales relationship.; Sales tooling (CRM) | United States | |
| Loom | Async video messaging used by our team for walkthroughs and support.; Video messaging and collaboration | United States | |
| Mixpanel | Product analytics; Product analytics on how account users interact with the Great Question app. Retains usage events to report on product adoption over time. | United States | |
| Mux, Inc | Transcodes, hosts and streams research session video. Stores video assets for playback for as long as the recording exists in the platform.; Video transcoding and hosting | United States | |
| Nylas | Email and calendar integration (Gmail, Microsoft); Powers the Google and Microsoft email and calendar integrations. Processes candidate names, email addresses and message content, and holds OAuth tokens for connected accounts while the integration is active. | United States | |
| OpenAI | Machine learning LLM provider; Processes anonymized and pseudonymized transcript and survey data for v1 AI features (Ask AI, synthesis, auto-highlights, tags, chapters, titles). | United States | |
| PostHog | Product analytics; Product analytics on Great Question app usage. Retains usage events to report on product adoption over time. | United States | |
| Recall | Meeting bots that join video calls and capture the call stream for research sessions.; Video call bots | United States | |
| Segment | Data and analytics pipeline; Event pipeline that routes product usage events and account user data to our analytics tools. Data is held transiently in transit. | United States | |
| Sendgrid | Email sending provider; Transactional email delivery. Processes recipient name, email address and message content; delivery logs are retained briefly for deliverability tracking. | United States | |
| Sentry | Application error tracking. Error context includes user ID and email so we can investigate issues; all other PII is scrubbed. Error events are retained for a limited period.; Exception handling and logging | United States | |
| Stripe | Payment processing; Processes subscription payments. Retains payment information and transaction history as required for billing and financial records. | United States | |
| Tremendous | Processing incentives; Sends incentive payments to research participants. Retains recipient name, email address and payment records as required for financial reconciliation. | United States | |
| User Interviews | Participant recruitment services; Recruits external research participants. Processes study criteria, screener responses and participant contact information for the duration of the study. | United States | |
| Vercel | Hosts front-end applications and routes AI inference requests. Request data is processed transiently.; Infrastructure provider, AI inference routing | United States | |
| Vero | Email delivery for candidate messaging. Processes candidate name, email address and message content; retains send history for deliverability tracking.; Email sending provider | United States | |
| Vitally | Customer success platform; Customer success platform. Retains account user demographics and product behavior to manage the customer relationship. | United States |
Listed as a subprocessor by (2)
Purposes as each company states them.
Changes
- Changed subprocessor: Google Cloud purpose: AI embeddings provider (Ask AI semantic search), Generates vector embeddings via the Gemini API for Ask AI semantic search and transcript indexing. Processes transcript text and user-entered Ask AI queries, which may include PII. → AI embeddings provider (Ask AI semantic search), Generate… evidence