Security and data protection
How Populiva protects research data and participants' privacy. For a completed HECVAT Lite, a data processing agreement, or other security questions, email tyler@populiva.com.
Where data lives
The application and database run on servers in a Hetzner data center in Ashburn, Virginia, USA.
Backups run every hour. Each is encrypted on our server before it leaves (with age, using a key Hetzner never has) and stored in a Hetzner Storage Box in Falkenstein, Germany. Hetzner can't read them. We test restores.
Encryption
All traffic uses HTTPS (TLS). Sensitive fields are encrypted in the database with AES-256-GCM: race or ethnicity, political party and views, household income, ZIP code, optional profile answers, W-9 details (legal name, address, taxpayer ID), messages, and appeals.
Pseudonymous by design
Researchers never see participants' names or emails. Each participant has a different PARTICIPANT_ID in every lab, so labs can't link people across labs. Messages block contact details. Provenance reports and the public quality report contain only totals.
The quality snippet researchers can add to surveys sends counts only (time, tab switches, pastes, typing speed), never answers or keystrokes.
Access control
Admin accounts require two-factor authentication. Researcher accounts use one-time sign-in links and two-factor authentication. Server access is by SSH key only, from an allowlisted address, behind a firewall that exposes only web traffic (plain HTTP just redirects to HTTPS).
Admin actions are written to an append-only audit log. IP addresses in that log are stored only as keyed hashes.
Money
Every movement of money is a double-entry ledger transaction that the database checks for balance and refuses to change afterwards. The ledger is reconciled every night.
How we build and run it
Every change passes automated tests (including accessibility checks), static security analysis, and dependency vulnerability audits before it ships. Servers install security updates automatically. Public forms are rate-limited.
Uptime and errors are monitored. Error reports are scrubbed of personal data before they leave our servers, and our analytics never receive IP addresses.
Service providers
Hetzner (hosting and encrypted backups), PayPal (lab payments and participant payouts), Resend (email, US), and PostHog (product analytics and error tracking, US; no names, emails, IP addresses, or answers). IP-address risk checks use MaxMind databases that run on our own servers, so no data is sent to MaxMind.
If something goes wrong
If we confirm a breach that affects a lab's or participant's data, we'll tell those affected without undue delay, and within 72 hours of confirming it, with what happened and what we're doing about it.
Retention and deletion
Labs can delete a closed study's participant-level data (shared demographics and in-survey signals) from the study page. We keep what payments, tax rules, fraud refunds, and signed provenance reports require. Participants can ask us to delete their account at any time.