Where your data lives and how it is protected
This page is a status report rather than a marketing promise: the measures in place, the physical location of the data and the assurances we do not currently give, all in one place.
Where data is stored
| Data | Location | Note |
|---|---|---|
| Accounts, plans, billing records and survey data (questions, responses) | Data centre in Türkiye (Istanbul) | The application servers and the database run on the same machine. |
| Images added to surveys, files and signatures uploaded by respondents | Germany (Frankfurt), Amazon S3 | Transfer abroad. Anyone who knows the file link can open the file. |
| Emails we send (account notices, contract copies, contact form) | Germany (Frankfurt), Amazon SES | Transfer abroad. Our company mailboxes are on Google Workspace. |
| Payments and invoicing | Türkiye: iyzico, Paraşüt | Card details never reach YouReply; payment is taken on the iyzico screen. |
Measures in place
All of the following are live today and can be verified in the code or the server configuration.
Encryption in transit
The site and the application are served only over HTTPS. The HSTS header tells browsers to reach this domain over a secure connection only.
Session security
Session cookies are marked httpOnly and secure and cannot be read by JavaScript. Sign-in goes through the central account.
Role-based access
Account roles (owner, billing, admin, member) and product roles (admin, editor, viewer) separate who can see and change what.
Organization single sign-on
Organization accounts can use their own identity provider with SAML 2.0 or OIDC after verifying their domain.
Anonymous response mode
In surveys marked anonymous, the respondent's IP address and location are not recorded.
Server-side validation
Required fields, value ranges and selection limits are checked again on the server when a response is saved.
Abuse limiting
Starting a large number of surveys from the same address in a very short time is rate limited.
Regular backups
The database is transferred to a separate backup server at regular intervals and kept for a defined period.
Assurances we do not currently give
We hold no independent security certification (such as ISO 27001) and have no published penetration test report. Data at rest in the database files is not separately encrypted. An uptime commitment applies only where it is agreed in an Enterprise contract; standard plans come with no service level commitment. If you are running a vendor assessment, take these into account and write to us for details.
Shared responsibility: what the researcher does
For survey responses the researcher is the data controller. The platform's tools make the work easier; the decisions are the researcher's.
- Inform participants: use the consent screen in the Settings tab or the consent checkbox question.
- Do not collect personal data you do not need; ask for names, emails and identifiers only if your research design requires them.
- If you need full anonymity, turn on anonymous response mode and avoid the meta info question, identifying questions and hidden fields that identify respondents.
- Do not collect sensitive documents such as ID documents or medical reports with file upload questions: uploaded files are reachable by anyone with the file link.
- Give team members only the role they need; use workspaces and projects to separate work.
- When your study ends, export the data and request its deletion.
Reporting a vulnerability
If you notice a security vulnerability, write to info@youreply.com.tr. Please include the affected address, the steps to reproduce it and a screenshot if you have one. Our contact details are also published in /.well-known/security.txt. We review reports and share the fix process with you; we ask that you give us time before sharing the issue with third parties.
Related documents
- Privacy Notice and Privacy PolicyWhich data is processed for which purpose and on what legal basis.
- Sub-processor ListThe providers that may access personal data and where they are located.
- Data Processing AgreementObligations of the researcher and YouReply for survey data.
- Account and Data DeletionHow to have your account and your survey data deleted.
Running a vendor security assessment?
Send us your questionnaire and we will answer in writing which items we meet today and which we do not.