Skip to main content
InviziPoll
Sign inStart free trial

Compliance alignment (informational)

How InviziPoll features can support a GDPR, SOC 2 or CCPA control narrative, with no certification claimed. Informational only, and never legal advice.

  • Compliance reviewers
  • 2 min read
  • Updated Oct 14, 2026
  • Reviewed by Security
Warning

Not legal advice: InviziPoll does not provide legal opinions. This page maps product behavior to common frameworks; it is not a certification, attestation, or contractual commitment.

The SIEM and Webhook Destinations tab. Explanatory text states that events sent to external SIEM systems are metadata-only, carrying no respondent data or response content, and that destination secrets are encrypted at rest and shown only once. A Destinations panel offers an Add destination button and reads No destinations yet.
Admin, Team, Webhooks - streaming audit events to a SIEM, metadata only.

This page still describes how product features may map to common compliance frameworks. We do not claim SOC 2 Type II certification, HIPAA compliance, or ISO certification unless explicitly published elsewhere with evidence.

#GDPR

  • Article 25 (data protection by design and by default): Minimal respondent metadata, client-side encryption, and anti-inference thresholds reduce unnecessary data exposure. Respondent IP addresses aren't stored: rate limits count by a keyed hash of the address that rotates daily, and each count is deleted once its window passes.
  • Article 32 (security of processing): Encryption of stored responses and least-privilege controls on operational access to sensitive data. Workspace keys can be restored through inbox recovery, which returns ciphertext only the user's password or recovery key opens; see the Threat model.
  • Storage limitation: each poll has a retention window after which its answers are deleted. Data retention and metadata boundary lists what else is kept and for how long.

#SOC 2

Organizations often map controls to logical access and encryption. InviziPoll's design may support your control narrative, but attestation requires your auditor and your scope; not this document.

#US state privacy and CCPA

Data minimization for respondent data and no sale of respondent analytics align with common privacy law themes. First-party analytics run on marketing pages and the signup page only, never on poll pages, and Global Privacy Control is honoured.

#Healthcare / HIPAA

InviziPoll is not presented as a HIPAA-compliant service by default. If your survey could collect protected health information, you need legal review, contractual terms, and careful survey design.

#Whistleblower and speak-up programs

Strong anonymity and anti-inference features can support organizational speak-up policies, but they do not replace legal obligations or jurisdictional requirements.

#Policies