> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insito.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Data protection and subprocessors

> Roles, where data is stored, who processes it, security measures and the Data Processing Agreement.

This page is for the person at your company who reviews vendors: what
Insito collects, where it lives, who else processes it, and how requests are
handled. For the end-user data itself and how to export or erase it, see
[Privacy and data requests](https://docs.insito.app/concepts/privacy.md).

> [!NOTE]
>
> The legal documents (Privacy Policy, Terms of Service and Data Processing
> Agreement) are being finalised with legal counsel. Email
> [jirka@insito.app](mailto:jirka@insito.app) if you need a signed DPA before
> they are published.

## Roles

* **Your app's users:** you are the controller and Insito is your processor.
  Insito processes their data only to run surveys for you, under your
  instructions and the DPA.
* **Your team's dashboard accounts:** Insito is the controller, as described in
  the [Privacy Policy](https://insito.app/privacy).

## What is collected

From your app, through the SDK:

* The `userId` you pass to `identify()`, plus any custom properties you send
* Events you trigger and screens the user visits (screen names are also
  counted per app, without a user)
* Device metadata: platform, OS version, app version, locale, timezone, session
  count, days since install
* Survey impressions and answers
* The device's IP address, used only for rate limiting and kept in request logs
  (never stored with the user's profile or answers)

The SDKs don't read advertising identifiers, contacts, location or any other
device identifier, and don't track users across apps.

From the dashboard: team members' names and email addresses, organisation
details, billing status and sign-in times.

## Where data is stored

Survey data and accounts are stored in a PostgreSQL database in the EU
(Frankfurt). Data is encrypted in transit (TLS) and at rest. Each
organisation's data is isolated at the database level with row-level
security, and the isolation is tested on every release.

## Subprocessors

| Subprocessor | Purpose | Personal data | Location |
| - | - | - | - |
| Supabase | Database, authentication, file storage | All customer and end-user data | EU (Frankfurt) |
| Railway | API hosting, encrypted database backups | All API traffic, request logs; backups are encrypted before upload | EU (Amsterdam) |
| Vercel | Dashboard and website hosting | Dashboard traffic, request logs | EU (Frankfurt), global CDN |
| Upstash | Cache, rate limiting, scheduled and background jobs | `userId`, throttle timestamps, IP addresses in rate-limit counters; queued notification emails (recipient addresses, workspace and app names) until delivered | EU |
| Stripe | Payments and invoicing | Billing contact and payment details | EU and US |
| Resend | Transactional email | Team members' names and email addresses | EU (Ireland) |
| Sentry | Error monitoring | Error reports with request bodies, headers and query strings removed | EU (Germany) |
| Slack | Optional integration, only if you connect it | The survey answers you choose to forward | US |

Transfers outside the EU rely on the EU Standard Contractual Clauses or the
EU–US Data Privacy Framework. We announce new subprocessors on this page and
by email at least 30 days before they start processing data.

## Retention and deletion

* End-user data: deleted automatically after your organisation's retention
  period (default 2 years). You can shorten it or erase one user immediately;
  see [Privacy and data requests](https://docs.insito.app/concepts/privacy.md).
* Organisation data: deleted immediately when you delete the organisation.
* Backups: encrypted, kept for 30 days (daily) and 12 months (monthly).
* Request logs: kept by the hosting provider for a limited period and never
  contain answers or request bodies.
* Audit log: kept for 2 years, then deleted automatically. It records who
  changed security-relevant settings (user IDs, token IDs, IP addresses) and
  identifies end users only by a one-way hash. It goes with the organisation
  when the organisation is deleted.

## Security measures

* TLS for every connection; HSTS on all web properties
* Row-level security on every table, with automated cross-tenant tests in CI
* Access tokens stored hashed, scoped, revocable and expiring; SDK keys can be
  rotated from the dashboard at any time
* Production access limited to named maintainers
* Append-only audit log of security-relevant changes, readable and exportable
  by every member (Settings → Audit log)
* Error reports scrubbed of personal data before they leave the API
* Backups encrypted with a key held offline, with regular restore tests

## Data Processing Agreement

The DPA covers the requirements of GDPR Article 28: processing only on your
instructions, confidentiality, security measures, the subprocessor list
above, help with data subject requests, breach notification without undue
delay, and deletion or return of data at the end of the contract.

Until the final version is published, email
[jirka@insito.app](mailto:jirka@insito.app) to request a copy.

## App store declarations

See [App Store and Google Play privacy labels](https://docs.insito.app/concepts/store-privacy-labels.md)
for what to declare when your app uses Insito.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.