Sub-processors
SurveyAnalytica (Cosmoneural Private Limited) uses the companies below to deliver the platform. Each one processes data only to provide its part of the service, on our instructions and under its data processing terms.
- Hosted on Google Cloud in the United States by default; Enterprise customers get a dedicated tenant in the region they choose.
- AI features run only when you use them, on SurveyAnalytica's own Google Cloud and OpenAI enterprise accounts: no data retention, no model training.
- ISO/IEC 27001 certified. Verify the certificate
Sub-processors that process Customer Data
These providers may process data you put into SurveyAnalytica (surveys, responses, contacts, messages, files) or data about your users.
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Google Cloud Platform & FirebaseGoogle LLCBAA available (Enterprise) | Hosting and compute (Cloud Run, Cloud Functions), databases (Firestore, BigQuery), file storage, messaging queues, encryption keys, logging, sign-in (Firebase Authentication) and push notifications. | All Customer Data: account and profile data, surveys, responses, contacts, messages, files, workflows and usage records. | United States (us-central1 and the nam5 multi-region) by default; Enterprise tenants in the region of your choice. | Privacy policyData processing terms |
| Google Cloud AI (Vertex AI Gemini, Cloud Translation, Cloud Vision, Natural Language)Google LLCBAA available (Enterprise) | AI features: response summaries, analytics and survey-building assistants, text classification, reply matching, image tagging and translation. Runs on SurveyAnalytica's own Google Cloud enterprise account; nothing is used to train Google's models. | Text and files sent to an AI or translation feature, such as survey content, free-text responses, message text and uploaded images. | United States (us-central1) | Privacy policyData processing terms |
| OpenAIOpenAI, L.L.C.BAA available (Enterprise) | AI copilots, content and image generation and the analytics assistant, when you choose to use them. Runs on SurveyAnalytica's own enterprise OpenAI account; nothing is retained or used to train OpenAI's models. | Only the content you submit to an AI feature. | United States | Privacy policyData processing terms |
| StripeStripe, Inc. | Subscription billing, invoices, and payments you collect in surveys and portals through Stripe Connect. | Billing contact details, payment card data (handled by Stripe; we never store full card numbers), transaction and payer details. | United States and other Stripe locations | Privacy policyData processing terms |
| Amazon Web Services (SES, SNS, S3)Amazon Web Services, Inc.BAA available (Enterprise) | Email delivery (Amazon SES), SMS delivery when you do not bring your own SMS provider (Amazon SNS), delivery, bounce and complaint notifications (SNS), and storage of inbound email (S3). | Email addresses, phone numbers, email and SMS content and attachments, delivery events. | Japan (ap-northeast-1) | Privacy policyData processing terms |
| VercelVercel Inc. | Hosting of the SurveyAnalytica web app, public survey and campaign pages, and customer portals. | Request data (IP address, browser details, URLs) and the page content served. | Global edge network; functions in the United States | Privacy policyData processing terms |
Service providers with no access to Customer Data
These providers measure how visitors use surveyanalytica.com and how your team uses the SurveyAnalytica app you sign in to. None of them runs on the survey, campaign or portal pages your respondents see. If you add your own Google Analytics ID to a survey, that data goes to your Google Analytics account under your own terms.
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| DatadogDatadog, Inc. | Error diagnostics for the SurveyAnalytica web app that your team signs in to, not the survey, campaign or portal pages your respondents see. | App users' interaction and device data, IP address and page URLs. Typed input is never recorded. | United States | Privacy policy |
| Google Analytics & Google Tag ManagerGoogle LLC | Usage analytics and tag management for surveyanalytica.com and the SurveyAnalytica app. | Visitor device and browser details, pages viewed, approximate location, cookie identifiers. | United States | Privacy policyData processing terms |
| Vercel Speed InsightsVercel Inc. | Page performance measurement (Core Web Vitals) for surveyanalytica.com and the SurveyAnalytica app, without cookies. | Page performance metrics, browser and device type, country. | United States | Privacy policyData processing terms |
Where your data is hosted
Customer Data is hosted on Google Cloud in the United States by default. Enterprise customers can choose another region: we set up a dedicated tenant in the region you need on request. Contact us to discuss data residency.
HIPAA (Enterprise)
Enterprise customers that handle protected health information can sign a Business Associate Agreement (BAA) with SurveyAnalytica. Under it, PHI is processed on a dedicated tenant in the region you choose, only by the sub-processors marked “BAA available” above, each of which has signed a BAA with us. To request the BAA, write to legal@surveyanalytica.com.
AI providers
AI features run only when you use them. Gemini, Translation, Vision and Natural Language requests run on SurveyAnalytica's own Google Cloud enterprise account, and copilots and generation run on SurveyAnalytica's own enterprise OpenAI account. In both cases your data stays in our accounts, is not retained by the provider and is never used to train models.
Integrations you connect
Services you connect yourself (for example WhatsApp Business, Slack, HubSpot, Mailchimp, Shopify, Google Sheets, Calendly or Microsoft 365), and SMS providers whose account you bring (Twilio or Telnyx), are your own providers, not our sub-processors. Data reaches them only when you set up the integration, under your agreement with that provider.
Changes to this list
We notify customers at least 30 days before a new sub-processor starts processing Customer Data, so you can object. Notices go to the email address of each account owner. To receive them at another address, or to object to a change, write to privacy@surveyanalytica.com.
Data Processing Addendum
For our Data Processing Addendum, including the Standard Contractual Clauses for international transfers, contact legal@surveyanalytica.com.
Have a question?
If you need more detail on any provider, a copy of a provider's data processing terms, or a security questionnaire completed, write to privacy@surveyanalytica.com. We reply within two business days.