Data Protection
A single reference for information governance reviews: storage locations, sub-processors, controller and processor responsibilities, and the concrete actions needed to get a study approved.
Every piece of study data sits in one of four places. Nothing is written to third-party analytics or advertising systems.
Participant records, study definitions, questions, responses, consent records, invites and audit logs are held in a managed PostgreSQL database with row-level security enforcing strict separation between organisations.
Uploaded media (photos, audio, video, documents) and study cover images are held in object storage with per-organisation access policies. Files are served through signed, time-limited URLs.
Account credentials, MFA secrets and session tokens are held in a dedicated managed authentication service. Passwords are stored only as salted hashes; researchers may enable TOTP two-factor authentication.
Server-side functions process data in memory to send invitations, queue messages and generate exports. No participant identifiers are sent to third-party AI services.
Optional channels are only engaged if your organisation enables them. Disable a channel and its processor never receives data.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Managed cloud platform | Database, authentication, file storage and serverless functions | All study, participant, response and account data | Confirm your project region in the Legal Annex |
| Resend | Transactional and invitation email delivery | Recipient email address, name, study name, invite link | EU / US — per Resend's DPA |
| Twilio | Optional SMS and WhatsApp delivery of invitations and reminders | Recipient mobile number (E.164), message body | Global — per Twilio's DPA |
| Cambridge Genetics Ltd | Optional genomic testing (GSA, WGS, PGx) where a study enables it and the participant opts in | Name, address, sample ID, genomic results | United Kingdom |
| AWS (hosting & CDN) | Application hosting, static asset delivery and TLS termination | Request metadata, IP address, no study payloads at rest | Global edge network |
Confirm hosting region, retention periods and any certification claims with us in writing before relying on them in a governance submission.
Work through these nine sections, record your assessments and lawful basis, then download a formal Governance Report PDF for your information governance review.
0 of 9 sections complete
Answers are saved in this browser only — nothing is sent to us.
The report compiles every answer above with the legislation that applies in your selected jurisdictions, a sub-processor annex, a consolidated legislation register and a declaration block, into a signable PDF for your information governance review.
Ready-to-paste answers for information governance and procurement questionnaires.
We will send the Data Processing Agreement, sub-processor annex, technical and organisational measures summary and DPIA starter template for your review.