Security & Data Retention

Security & Data Retention

Great Question applies security best practices at every layer — from infrastructure and authentication to internal processes — and gives Admins configurable tools to manage data retention and compliance.

What is Security & Data Retention?

Security & Data Retention covers two areas of your Great Question workspace: the security controls that protect your data, and the retention rules that let you automatically delete recordings or candidate data after a configurable time period. Together, these features help you meet compliance requirements like GDPR, CCPA, and HIPAA while keeping your research operations running smoothly.

Why It Matters

Protect participant data at every layer. Great Question uses SOC 2 Type II certified controls, TLS encryption in transit, AES-256 encryption at rest, and field-level encryption for sensitive credentials — so your data is protected whether it is moving or stored.

Stay compliant with privacy regulations. Built-in support for GDPR, CCPA, and HIPAA means you can honor participant data rights, execute data processing agreements, and enforce retention policies without relying on manual processes.

Control exactly how long data lives in your workspace. Configurable retention rules let Admins set custom deletion schedules for recordings and candidates, supporting data minimization without removing the research context you need.

Enforce access at every level. Role-based access controls, team-scoped permissions, and SAML SSO.

Infrastructure and Encryption

Great Question's infrastructure is hosted on Heroku, using SOC 1, SOC 2, and SOC 3 certified data centers in the US-1 West region. All data in transit is encrypted with TLS, and data at rest uses AES-256 block-level encryption. Security posture is continuously monitored through Vanta, with regular penetration tests and policy reviews.

Authentication

Great Question supports multiple authentication methods that can be configured at the account level.

Password — Passwords must be 8 to 70 characters and include at least one uppercase letter, one lowercase letter, one digit, and one special character.

Google OAuth — Sign in using your Google account.

OpenID Connect — Allows users to sign in with their Microsoft accounts.

SAML SSO — Supported identity providers include Okta, Azure AD, OneLogin, JumpCloud, and Google. Multiple SAML providers can be configured per account.

Roles and Access Controls

Great Question uses a role-based access control system with four system roles:

Compliance

SOC 2 Type II

Great Question has completed SOC 2 Type I and Type II audits, with continuous monitoring through Vanta.

GDPR and CCPA

Great Question supports your compliance needs as both a data processor and a partner in protecting participant information.

Right to Access and Portability — Request data exports via [email protected].

Right to be Forgotten — Full deletion across our systems and sub-processors.

Right to Object — Participants can opt out per study or across the account.

Right to Rectification — Users can make updates directly or by contacting support.

Data Processing Agreements (DPAs)

If your legal or security team requires a DPA, contact support to request one. Enterprise plans support review and signing of custom DPAs.

HIPAA

HIPAA compliance is available for qualifying accounts. Contact your Customer Success Manager or Support for details.

Data Retention

Admins can create data retention rules that automatically delete recordings or candidate data after a configurable time period. This supports data minimization and compliance with privacy standards such as GDPR and CCPA.

Configurable Retention Periods

When creating a rule, you can choose from preset durations — 1 month, 2 months, 3 months, 6 months, 1 year, or 2 years — or set a custom duration of any value up to 100 days, weeks, months, or years. Each rule applies to a specific resource type and is scoped to your account.

Resource Types

Data retention rules can target Recordings or Candidates.

Recordings — When a recording is deleted, the following associated data is also removed: transcripts, AI-generated summaries and chapters, highlights linked to the recording, and video files and thumbnails.

Candidates — When a candidate is deleted via a retention rule, screener responses are destroyed, clips are removed from highlight reels (reels are automatically restitched), participations and linked recordings are discarded, and PII (name, email, phone number) is anonymized.

What Stays Intact

Studies, incentive records, data retention audit logs, and the retention rules themselves are not affected by data retention deletions.

How Deletion Works

Data retention runs as a two-stage background process. First, the system identifies records that have exceeded their retention period each day and marks them for deletion in an audit log. Then, marked records are processed and soft-deleted. Audit logs track the status of each deletion as pending, completed, or failed. Records are never deleted before the rule's activation date, ensuring no retroactive deletions occur immediately upon rule creation.

Audit Trail

Every data retention action is logged in a dedicated audit trail. Logs track when a record was scheduled for deletion, when it was actually deleted, whether it succeeded or failed, and who approved the rule. Audit logs are permanently retained even after the associated data is removed.

How to Set Up Data Retention Rules

1. Click your name in the bottom-left corner and select Account.
2. Navigate to Governance > Data Retention.
3. Click New Rule to create a retention rule.
4. Select the resource type (Recording or Candidate), set the retention period, and preview which records will be affected.
5. Activate the rule. You can pause, resume, or archive rules at any time.

Rule Statuses

Troubleshooting

Data Retention

Authentication

Permissions and Access

Still need help? Contact us at [email protected] — we're happy to help!