Security at Thisys

Hosting

Thisys runs on DigitalOcean infrastructure. Where survey definitions, responses, contact lists, uploaded files and backups are stored is listed with DigitalOcean in the sub-processor table below.

The application, database and file store run on hardened Linux hosts behind a reverse proxy. The only services reachable from the internet are HTTP on port 80 (which redirects to HTTPS), HTTPS on port 443, and SSH on port 22 for administration. SSH accepts public-key authentication only, and repeated failed attempts are banned automatically. The database, the application processes and every other port are closed at a cloud firewall that sits outside the machine, so they stay closed even if the host itself is misconfigured.

Encryption

All traffic between your browser and Thisys, and between Thisys and every service it calls, is encrypted with TLS. Plain HTTP requests are redirected to HTTPS.

Account passwords are hashed with Argon2id, the current OWASP recommendation, and never stored or logged in clear text. Passwords migrated from SurveyFace are upgraded to Argon2id when the account next signs in. API keys and tokens are stored as hashes; the clear value is shown once, at creation. A survey's optional results-sharing code is also stored as a salted scrypt hash: it cannot be displayed again once set, only replaced or removed. Two secrets must be readable again — a collector's respondent access code, the short code you read out to a room before people answer, and a webhook's signing secret — so those are encrypted in the database (AES-256-GCM under a key derived from the server's secret) and shown only to the people who run the survey (a webhook's secret only to the survey's creator and the team owner), never to a respondent.

At-rest encryption specifically: Thisys does not add its own additional encryption layer on top of the database disk or the file-storage bucket our hosting provider (DigitalOcean) gives us, and the nightly backup files kept on the server are compressed, not separately encrypted; the off-site copy of each night's database backup is encrypted (AES-256) before it leaves the server. If your organisation requires encryption at rest as a contractual control, ask us through the contact page before you rely on this platform for that data.

Access control

Every account has a single owner. Survey results and share links are private by default and are opened to others only when the owner chooses to share them. A shared results dashboard can additionally be put behind an access code, and given a new address at any time (Make a new link), which stops the old address working immediately. A shared CSV download link has no access code: its protection is an unguessable token you can revoke or rotate at any time, which stops the old link working immediately.

Two-factor authentication guards the email-and-password route. Your authenticator code is required when you sign in with your email and password; signing in with Google or Microsoft does not ask for it, and those sign-ins rely on the security of that account instead, including any two-factor you have set up there. Administrator accounts are the exception: an administrator who signs in with Google or Microsoft must also enter the authenticator code before the session can be used. On your own computer you can tick Remember this device when you enter the code (it is never ticked for you): that browser is then not asked for the code for 30 days from its last use, or 7 days for an administrator account. Changing your password, turning two-factor off or signing in with a recovery code forgets every remembered browser, and the Login & security tab lists them so you can forget one or all.

Thisys staff do not read customer survey data in the course of normal operations. Administrative access is limited to named staff and is used only to resolve a support request or an incident, or to review a survey link that the safety check below has held or a respondent has reported. For that review staff read the survey's wording, not its responses.

Sign-in is protected against credential stuffing by rate limits, temporary lockout after repeated failures, and email-verified password resets. Two-factor authentication with any authenticator app is available to every account and required for administrators; recovery codes cover a lost phone.

Sign-in with Google or Microsoft is available on every plan. Single sign-on through your own identity provider (SAML or OIDC) and passkeys are not built yet; single sign-on is listed as under consideration on the Features page.

Keeping survey links safe

Thisys checks every new public survey link before respondents can answer it, so the platform is not used to phish people. Fixed rules read all the wording a respondent can see (the title, page text, questions, answer options, messages and translations), and a quick AI read of the same wording follows, cutting very long passages to their start and end; when the AI is not available the rules still run. The fixed rules read the common phrasings of password, PIN, card and bank-login requests in English and 27 other languages (those AI translation serves well); the AI check covers the rest. This is on every plan, Free included.

A survey the fixed rules read as asking for passwords, PINs, one-time codes, card numbers or CVV, or bank logins does not open. A survey that looks like a scam in another way is held for a person to review: a job offer that asks for bank details, a request for a tax file, Medicare, passport or licence number, crypto or a wallet, a link to a site we do not know, a bank's or government service's name beside a request for personal details, or a clear imitation of a bank or government service as the AI judges it. How strict the hold is depends on the account's history: on an established paid account with a clean record such a survey opens and is listed for staff to look at. A password or card ask in wording the fixed rules do not read is treated the same way. An ordinary survey opens at once. If the automatic check cannot run at that moment (it is paused or unavailable), a new or Free account's survey that has not passed the check before waits for a person at Thisys instead, usually within one business day; on a paid, established account, or for a survey that passed before, the link opens on the fixed rules. A survey that is only about passwords, banking or scams, and does not ask for them, is meant to pass.

Held and stopped links go to a review queue that Thisys staff work through, usually within one business day. Staff approve, reject with a reason the author reads, or suspend a survey, a link or an account, and the author is emailed each decision. While a link is held, a respondent who opens it reads "This survey is being reviewed. Please try the link again later." (in the respondent's language where Thisys has built-in respondent text: the language they picked, the link's ?lang=, or their browser's), and the page is not indexed by search engines. Changes to the wording of a live survey are checked again once the edits settle. How strictly a doubtful survey is held depends on the account's history, and staff see every one either way.

Every respondent page also carries a Report this survey link beside the privacy link, white-label surveys included, except on the demo's example surveys, which record nothing. It opens a short form: what is wrong, what happened, and contact details only if the reporter wants a reply. Reports reach Thisys staff at once, behind bot protection and rate limits. A report stores a one-way hash of the reporter's address rather than the address itself, and the form collects anonymously, so no IP address, location or browser details are kept with the response either. A report never removes a survey by itself: a person decides. A removed survey reads "This survey has been removed."

The same rules read every email a customer writes to other people through Thisys: invitations, reminders, messages to their contacts and follow-ups to a respondent. One that asks for passwords, PINs, card numbers or bank logins is refused and not sent. One the rules list for review, such as a link to a site we do not know, a request for an ID number or a prize that asks for a fee to claim it, is held, and nothing goes until Thisys staff release it.

A background abuse watch also re-reads the wording of live surveys every 15 minutes and looks for bursts of sign-ups, responses or link-filled answers from one IP address. What it finds is listed for Thisys staff to review: a survey it flags is held until staff decide, and an IP address is blocked only when a staff member confirms it, never automatically. A blocked address is refused when it tries to register, create or publish a survey, or send an answer or a file through a survey link; the block, and the finding behind it, are removed after 90 days. Staff are emailed a daily report whenever there is something to act on, or when the watch itself is paused, behind or failing.

No automatic check is perfect. If a Thisys survey asks you for a password, a PIN or card details, do not give them: press Report this survey on that page.

Browser protections

Every page sends a Content-Security-Policy that limits where scripts and other content may load from. Sign-in and account recovery, surveys, public results, status and every signed-in page allow only scripts that carry a one-time value made for that request, so injected script cannot run there.

The public marketing pages are the exception: the home page, Templates, Use cases, Features, Pricing, the Help Centre, Question types, Survey tips, Guides, Solutions, the comparison pages, About us, Testimonials (once the first story is published), Community, the Privacy Policy, the Terms and this page. They are the same for every visitor and are cached to stay fast, and a cached page cannot carry a one-time value, so their policy allows inline scripts from the page itself. They show no customer data and take no survey answers.

Backups and continuity

The database is backed up every night, and the last 14 days of those backups are kept on the server. An encrypted copy of each night's database backup is also kept for 30 days in separate storage in the same region, and our hosting provider (DigitalOcean) takes a backup of the whole server every day.

Point-in-time recovery is also on: every change to the database is copied, encrypted, to that separate storage at least once a minute, so the database can be restored to any minute of the last 29 days. A restore onto a new server was rehearsed on 5 October 2026.

Uploaded files (survey images, logos and files that respondents attach) are kept in DigitalOcean Spaces object storage. They are not yet backed up separately from it; a separate backup of uploaded files is planned.

A watchdog restarts the application if it stops responding. Planned maintenance is announced ahead of time on the status page (/status) and in a banner across the site.

Retention and deletion

You control how long responses are kept: each survey can carry a retention period after which responses are purged automatically by a daily job. Deleting a survey asks you to type a confirmation first, then moves it to Deleted surveys on My Surveys for 30 days: its links, shared results and certificates stop at once, and you can restore it until the 30 days are up, when it and its responses are deleted for good. Pages and questions you delete inside a survey wait in that survey's trash for 14 days, so a mistaken edit can be undone.

A response from a link that records location keeps the respondent's IP address for 90 days after it was started; then the address is removed and the approximate place (the country, and the region and city where known) stays with the response. Where the answers are kept longer than that, the respondent's privacy line says so: "Your IP address is removed after 90 days." The IP address recorded at an account's sign-up and most recent sign-in is removed after 90 days in the same way. A response collected before location recording began has no place and keeps its IP address for as long as the response is kept.

When you close your account (confirmed through a link sent to your email address), its surveys, responses, contacts and files are deleted from the live system, and from backups within 30 days as those age out.

You can export your survey definitions and responses at any time in CSV, Excel, SPSS and PDF formats, with an R analyst bundle and PowerPoint and Word reports, so your data is never locked in.

Protect · Data retention tab

— enlarge

AI features and your data

Thisys's AI features (survey generation, translation, response analysis, follow-up questions to respondents on links whose owner switches them on, the assistant and the safety check of new survey links) send only what is needed for the task to Thisys's one AI provider, Anthropic, over an encrypted connection: usually text and figures worked out from survey answers (counts, averages and scores), and on the AI page a picture you attach (as the image itself) or the text of a file you attach. Anthropic processes it in the United States under commercial API terms that do not permit training on it.

Dictation (the mic) uses your browser's own speech recognition: your browser's maker (for example Google in Chrome, Microsoft in Edge) may process the audio. Thisys receives only the text.

Response analysis is off until the survey owner turns it on, and follow-up questions also need the owner to tick them for each link, and the platform can be configured to disable third-party processing of response data entirely for customers whose contracts require it. The safety check reads the wording of a survey link, never the responses.

AI output is a suggestion, with one exception you should know about. The AI builder and the home box can create a survey, its suggested skip logic and an open web link in one step; you can review, edit or close the link at any time. That link goes through the same safety check as any other new link. Everything else the AI writes, such as reports, themes, translations and flags, is a draft until you accept it.

On the AI page and through the actions API, the AI proposes and you decide: a change is made in your account only when you press Apply (or your own software applies it with an API key allowed to make changes), it is made as you, with no more access than you have, a change people answering a survey will see asks you to confirm first, and a delete asks you to type the name of what goes. Payments, plan changes and passwords are never done by the AI. Every request is kept in your AI log, where a change to a survey's or a link's settings can be put back for 24 hours.

Incidents and disclosure

If a security incident is likely to result in serious harm to the people whose data is affected, we notify affected customers and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and customers in other jurisdictions in line with their laws, as soon as practicable and no later than 72 hours after we confirm the breach.

Security researchers who find a vulnerability, and anyone with a privacy concern, are asked to report it through the contact page: on the "Send a Message" tab, choose "Security or privacy report" as the issue. Those reports go straight to a person rather than to the instant-answer assistant, and the same contact route is published for security tools at /.well-known/security.txt. We acknowledge reports within two business days, do not pursue good-faith research, and credit reporters who want it once the issue is fixed.

Sub-processors

These are the third parties that may process customer data or account information on our behalf. Two see far less: Plausible counts visits without cookies or personal data, and MillionVerifier checked email addresses once, in October 2026, for the SurveyFace move. We keep this list up to date.

Agreements

Our Privacy Policy sets out our roles under the Australian Privacy Act and the GDPR: you are the controller of the data your surveys collect and Thisys is your processor. If your organisation needs written data-processing terms, ask us through the contact page.