Security and privacy, in plain English.

We're built for live audiences — so we only collect what a vote needs, encrypt it on the way in, and hand it right back to you. No tracking pixels, no shadow profiles.

Encryption everywhere

TLS 1.2+ in transit, AES-256 at rest. Secrets in a managed KMS. No audience identity required to vote, so there's rarely anything sensitive to encrypt in the first place.

Access controls that match your org

Role-based access on Team plans. SSO with Google and Microsoft on Team. SAML SSO + SCIM provisioning on Enterprise. Full audit log of who created, changed, or launched every poll.

Anti-fraud without surveillance

Device fingerprinting prevents duplicate votes without collecting personal data. Optional authentication mode for high-stakes polls. You choose how strict to get.

Data you own — and can export

You own your data, full stop. CSV export from Creator up, REST API on Team+. Delete a workspace and we delete it — not just flag it.

Compliance posture

Where we are today, and where we're going. No hand-waving.

GDPR readyActive

FERPA awareActive

SOC 2 Type IIn progress · 2026

WCAG 2.2 AAActive

EU data residencyAvailable on Team+

BAA / DPAAvailable on Pro+

99.99% SLAEnterprise

Annual penetration testActive

Sub-processors

The vendors we use to run QR Polls. Updated when things change.

Vendor	Purpose	Region
Vercel	Application hosting & edge network	Global, EU data residency available
Neon	Managed Postgres database	Per-workspace region selectable on Team+
Supabase	Auth & storage	Per-workspace region selectable on Team+
Stripe	Payment processing	US/EU per payment method
PostHog	Product analytics (self-hosted option)	EU cloud
Resend	Transactional email	EU

Need a DPA, BAA, or pen-test report?

We share them on request with qualified prospects and paying customers. Reach out and we'll route you to the right person.

Contact security See pricing

Loading polls...