Security & Data Protection

Where Your Data Lives

SurveyNinja runs on a server in the European Union. Every request reaches it through Cloudflare, which serves the site and your surveys over HTTPS and filters malicious traffic before it gets to us.

Files your respondents upload sit on separate storage servers. They are copied between two machines, and previous versions of a file are kept for 90 days.

Application and database on a server in the EU
Cloudflare in front of every request
Uploaded files replicated across two storage servers
Monitoring with instant alerts to our team

Encryption & Protection

HTTPS everywhere

The builder, your published surveys, reports shared by link and the API are all served over HTTPS, so answers travel encrypted from the respondent to us.

Passwords and secrets

Passwords are stored only as bcrypt hashes, and API keys only as hashes. Your SMTP password, storage keys and two-factor secrets are encrypted with AES-256.

Activity log

See who created, published, edited, moved or deleted a survey, who exported or deleted answers, and who changed roles or access. No one can edit or delete entries, and the log exports to CSV (Premium and Enterprise).

Access Control

Roles and folder access

Owner, admin and member roles out of the box. On Premium and Enterprise, build your own roles with allowed, partial or forbidden permissions, different for each folder.

Single Sign-On (SSO)

Your team signs in through any OpenID Connect provider, such as Okta, Microsoft Entra ID, Google Workspace or Keycloak. The owner can turn off password sign-in (Premium and Enterprise).

Two-factor authentication

Codes from an authenticator app plus eight recovery codes. On every plan, Free included: with it turned on, a leaked password alone opens nothing.

Sign-in protection

After repeated failed sign-in attempts the IP address is blocked for 24 hours. Surveys can switch on Google reCAPTCHA to keep bots out of your answers.

Backup & Recovery

Every night the whole database is backed up, followed by files and configuration. The copies go to a separate server and are kept for 30 days.

Full database backup every night
Copies on a separate server, kept for 30 days
Survey history: restore an earlier published version
Deleted surveys and answers can be restored

Privacy & GDPR

Stored in the EU

Accounts, surveys and answers are stored on our server in the European Union.

Anonymous responses

One switch keeps the IP address, browser, country and device out of reports, exports and integrations.

Your data, your call

Export answers to CSV, Excel or SPSS whenever you need them, on every plan. Delete answers or whole surveys when you no longer need them.

On-Premise Option for Maximum Control

For organizations that cannot keep data in someone else’s cloud, SurveyNinja is available on-premise. Our team installs the platform on your own servers, and survey data never leaves your perimeter.

All data stays inside your infrastructure
Deployed in Docker on your servers
Runs behind your own firewall
Your team controls backups, monitoring and network access

Learn about On-Premise

Frequently Asked Questions about Security

Where is SurveyNinja data stored?

On our server in the European Union. Backups and uploaded files are kept on separate storage servers, and every request reaches us through Cloudflare.

How does SurveyNinja help with GDPR?

Answers are stored on a server in the EU, Anonymous responses keep the IP address, browser and location out of reports and exports, and you can export or delete answers at any time. When a survey collects personal data, add a consent question at the start. Send your GDPR questions to team@surveyninja.io.

How does SurveyNinja protect data?

Every connection uses HTTPS. Passwords and API keys are stored only as hashes, and secrets such as SMTP passwords and two-factor keys are encrypted with AES-256. The database is backed up every night to a separate server.

Can SurveyNinja run on our own servers?

Yes. Our team deploys SurveyNinja in Docker on your servers, and survey data stays inside your perimeter. See the On-Premise page for details.

Can we see who did what in our workspace?

Yes. On Premium and Enterprise the activity log records survey changes, answer exports and deletions, and changes to members, roles and folder access. No one, including the owner, can edit or delete entries, and you can export the log to CSV for your own audit.

Can I control who has access to survey data?

Yes. Use owner, admin and member roles, custom roles with per-folder permissions on Premium and Enterprise, SSO over OpenID Connect, and two-factor sign-in, which works on every plan.