Higher Education Community Vendor Assessment Toolkit.

Domandata is a survey and research data-collection platform built for academic and institutional researchers — survey authoring, distribution, response collection, and analysis in one product.

Privately held, founder-owned. Domandata is operated by two founders.

There is no dedicated security team; a Security Lead role (currently held by a co-founder) owns the security program, policies, and this questionnaire, consistent with the company's two-person size.

security@domandata.net — monitored directly by the founders, with an acknowledgment commitment for reported issues.

U.S.-based company. Production infrastructure runs on U.S.-based cloud providers (Vercel for hosting, Supabase for the managed database).

Not yet. SOC 2 Type I is in progress: framework adopted, all 34 Trust Services Criteria mapped, all 10 policies written and formally approved, and the large majority of underlying controls evidenced. Auditor engagement and report issuance remain.

Not currently pursued.

Not applicable — Domandata does not currently serve U.S. federal or state government agencies requiring FedRAMP/StateRAMP.

Published and downloadable at domandata.net/trust/caiq.

Both infrastructure providers — Vercel (hosting) and Supabase (database) — hold SOC 2 Type II certification.

Managed through a dedicated GRC platform (GOCO): all 10 policies approved, controls mapped to SOC 2 criteria, evidence uploaded per control, and a maintained risk register.

All changes to `main` require a pull request, review by a second engineer, and passing automated checks (ESLint, TypeScript, dependency audit) before merge.

Static analysis (linting, type checking) runs on every change. A weekly OWASP ZAP baseline (DAST) scan now runs in CI, but it currently covers only the public marketing/trust-center surface, not authenticated app routes or the respondent-facing survey runner — kept as Partial rather than Yes until coverage is broader.

No third-party penetration test has been performed to date. Open item.

Multi-tenant by institution/researcher account. Isolation is enforced with Postgres Row-Level Security at the database layer, not only in application code, so an application bug cannot leak one institution's data to another.

TLS 1.2+ enforced on all connections, with HSTS preventing any unencrypted fallback, including on first visit.

TOTP-based MFA is fully live for all accounts; workspace Owners can require it for every member of their workspace.

Institutional SSO and federated identity are not implemented. Institutional access is currently provided through a granted-plan model instead. Disclosed as a genuine current limitation for institutions that require SSO.

bcrypt; passwords are never retrievable in plaintext by the platform or its operators.

Owner / Member / Survey Collaborator (Editor or Viewer) roles, enforced at the database layer.

Written to an append-only audit log, retained a minimum of one year, reviewed on a semiannual cadence.

API keys are shown once at creation, stored only as a hash thereafter, and independently revocable.

TLS 1.2+ in transit; two layers at rest — database-level encryption plus an application-level AES-256-GCM layer for response content, with the key held separately from the database.

A Data Classification & Handling Policy defines general-use data, sensitive data permitted with disclaimer, and explicitly forbidden data (payment card data).

No FERPA-specific technical controls exist. FERPA-adjacent data is permitted on the platform with a disclaimer, but compliance responsibility rests with the institution; Domandata does not represent the platform as independently FERPA-certified.

Infrastructure providers are U.S.-based companies and production data resides with them, but a specific hosting region is not currently fixed by contract or published. Available on request during a vendor review.

Data can be exported at any time in open formats (CSV, JSON, SPSS .sav, Stata .dta) via the UI or public REST API — not gated behind contract termination.

Audit-log retention (minimum one year) is documented, as is survey-version retention behavior, but a single consolidated retention schedule covering all data categories has not yet been formalized as its own policy.

Self-serve account deletion permanently removes surveys and all associated response data from the production database.

No. Domandata is fully cloud-hosted on managed platforms; this category is entirely inherited from infrastructure providers.

Both the hosting provider and database provider are SOC 2 Type II certified, which covers physical and environmental controls at their facilities.

The platform is fully serverless/managed; there is no self-administered VM or server infrastructure to secure or patch.

An internal vendor inventory documents infrastructure, billing, and secrets-management providers with data access.

Published at domandata.net/trust/subprocessors, including a commitment to give 30 days' notice before engaging a new sub-processor.

An annual vendor security review runbook is in place; each vendor's own published security/compliance attestation is checked against Domandata's requirements.

The published sub-processor list (domandata.net/trust/subprocessors) commits to updating the page at least 30 days before a new sub-processor is engaged.

Ten policies covering access management, boundary protection, change control, event logging, incident response, malicious code protection, data classification, business continuity, vendor risk, and code of ethics/acceptable use.

All 10 policies are approved (verified current status: 8 approved June 18, 2026; the Data Classification and Code of Ethics policies were updated with new sections and re-approved July 21, 2026).

Each policy commits to at least an annual review; audit-log and program review additionally run on a semiannual cadence (January/July).

A SOC 2 Type I readiness risk assessment was performed and a risk register is maintained with named risks and disposition status.

A Security Lead role is designated (referenced by title, not name, so it remains valid across personnel changes).

Both founders have read and confirmed the full linked policy set (Code of Ethics, Incident Reporting, Account & Access Management, Malicious Code Protection).

Founders are not subject to formal pre-access screening, as they are owner-operators of the company. Any future employee or contractor granted system access will undergo basic screening (identity verification and, where legally permissible, a reference or background check) before access is granted, per written policy.

New personnel receive onboarding training on incident recognition and reporting, with refresher guidance at least annually; both founders have completed this.

The Code of Ethics and Acceptable Use Policy requires personnel to treat customer data as confidential and prohibits use for personal benefit or disclosure to unauthorized parties.

A revocation process is defined in policy and straightforward given current team size and centralized dashboard-based access, but it has not yet been exercised against a real departure, so it is unverified in practice.

A founder-approved BC/DR policy defines recovery objectives, recovery procedures per system layer, and disruption scenarios (including a founder-unavailability continuity provision: the remaining founder has documented access to all production systems, secrets stores, and recovery procedures).

RTO: 4 hours to restore core application functionality. RPO: 24 hours maximum data loss, aligned with the database provider's automated daily backup schedule.

Automated daily backups run via the managed database provider (upgraded specifically to close a prior gap where a lower tier had zero automated backups). Policy commits to an annual restoration test, but the first such test has not yet been performed — disclosed as not yet executed, not as complete.

Hosting and database are both single-region; no multi-region failover is configured. Disclosed as an accepted current limitation.

Policy requires testing at least annually; a documented test has not yet been performed since the policy's approval.

Policy commits to notifying affected customers within 4 hours of confirmed impact, with status updates at reasonable intervals, approved by the CEO or designee.

`npm audit --audit-level=high` runs on every pull request and on a weekly schedule in CI; automated vulnerability alerts from the source-control provider are enabled.

Vulnerabilities are remediated promptly on discovery in practice (most recently, all findings resolved via patches and narrowly scoped version overrides), but a formal written remediation-SLA commitment is not yet documented.

No third-party penetration test has been performed to date. Open item, tracked as a known gap.

Baseline DDoS and edge protections are inherited from the hosting platform; no independently configured WAF ruleset exists beyond platform defaults.

Framework and dependency updates are pulled in as part of normal development; no known unpatched high-severity vulnerabilities at time of writing.

No dedicated FERPA certification or safeguards. FERPA-adjacent data is permitted with a disclaimer; the institution is responsible for determining whether use of the platform for such data is appropriate under its own FERPA obligations.

No formal accessibility audit or VPAT has been produced to date. Disclosed as a genuine open item — a common requirement in higher-ed procurement that has not yet been addressed.

Not applicable. Domandata is a survey/data-collection SaaS product; it does not involve export-controlled technology, and no export control program is required.

Not implemented. Institutional access currently uses a granted-plan model rather than federated campus identity.

A public Trust Center (/trust), detailed Security page (/security), a generated IRB/security-overview letter, and this HECVAT and the CAIQ are all provided specifically to support IRB and institutional review submissions.

Not yet confirmed in place as a dedicated policy. This is an open item pending a business decision, not a technical control — institutions with a hard insurance requirement should confirm current status directly with security@domandata.net before contracting.

Not yet confirmed in place. Same disclosure as INS-01 — verify directly for current status.

Stated plainly in the public Security page and Terms of Service: surveys and response data belong to the customer; Domandata does not claim ownership, analyze, or monetize it.

No formal contractual right-to-audit clause currently exists. Institutional security review is instead supported cooperatively — through this HECVAT, the CAIQ, and documentation provided on request — rather than a contractual audit right.

In practice, data remains exportable in open formats at any time and is deleted on account closure per the Data Classification and Handling Policy, but this is not yet codified as an explicit contractual clause distinct from the Terms of Service.