Security & Data Handling

Last updated July 26, 2026

Overview

This page answers the questions clients most often ask before running a study on Wavefield: how your data is isolated from other clients, how it's protected, and what happens to it when you delete a survey or close your account. It describes the platform as actually built, not aspirationally — see the caveats at the bottom for the specific things we can't yet claim.

Account isolation

Every request the platform makes to its database is scoped to the account that owns it. One client's projects, surveys, responses, and contact lists are not merely hidden from another client — they are structurally unreachable through the application, because every query is filtered by account ownership at the code level, not by a visibility setting that could be misconfigured.

Encryption

All traffic to and from the platform is encrypted in transit (TLS), enforced automatically by our hosting provider on every request.

Data at rest is encrypted on our database provider, Neon, which encrypts stored data using AES-256 and holds its own SOC 2 Type II certification as an infrastructure provider.

Authentication

Passwords are never stored in plaintext: they're hashed with scrypt and a unique salt per account. Session tokens are opaque and stored hashed, so a database compromise alone does not expose usable credentials or active sessions.

Respondent links

Every invitation sent to a respondent carries a unique, single-use link. Links resist URL tampering and are protected against duplicate or concurrent submissions, so a respondent cannot complete the same study twice through the same or a copied link.

Data deletion

Deleting a survey is a real, immediate, permanent deletion — not a soft-delete flag. It removes the survey definition, every response, respondent sessions, uploaded contacts, chat history with the AI agent, and payment records tied to it. Clients can delete surveys, individual responses, and contacts at any time from the platform, and can request full account deletion by writing to support@wavefieldresearch.com; we honor deletion requests within 30 days.

Subprocessors

We use a small, named set of subprocessors, each receiving only what its function needs:

Vercel — hosting
Neon — database
Anthropic— AI survey generation, translation, and (only when an analyst requests it) open-end response coding — the one place respondent-submitted free-text answers are sent to a third party for processing
Resend — email delivery
Twilio — SMS delivery
Sentry — error monitoring

We never sell contact information, and never use one client's contact lists or response data for any other client or purpose.

SMS and email consent

Sending a text invitation requires an explicit, SMS-specific consent attestation from the client — this is enforced by the API itself, not just a policy: a send request without it is rejected. Replying STOP to any Wavefield SMS is honored automatically and immediately.

What we can't yet claim

Two things worth being direct about. First, Neon holding SOC 2 Type II certification is Neon's certification as our infrastructure provider — Wavefield Research itself does not currently hold SOC 2 or ISO 27001 certification as a company. Our infrastructure is SOC 2-backed; we are not (yet) independently certified.

Second, we don't have a standing, pre-signed Data Processing Agreement template. If your organization requires one contractually (common for GDPR-subject or enterprise clients), write to support@wavefieldresearch.com and we'll work through it with you.