Trust Center · Sub-processors

Who we share data with.

These are the third parties Domandata engages to deliver the platform, each bound by a written agreement. We do not include vendors that never touch customer or respondent data.

Last reviewed: August 2026

VercelSOC 2 Type II

Application hosting and edge network

All request traffic, including Personal Data in transit

Location: United States

SupabaseSOC 2 Type II

Managed database, authentication, and storage

All Personal Data submitted to the platform, including survey response and respondent data (encrypted)

Location: United States

StripePCI DSS Level 1

Subscription billing and payment processing

Customer's own billing contact and payment details — never survey response or respondent data

Location: United States

SentryStandard data processing agreement

Application error monitoring

Error diagnostic events only; configured to exclude request bodies and raw response content

Location: United States

Optional Integrations

Connected only if you choose to.

Unlike the sub-processors above, these only receive data when an authenticated user explicitly connects them and directs data to them — they are not part of the default data flow for every customer.

Open Science Framework (OSF)

Preregistration / research repository, connected at the researcher's choice

Researcher-authored survey materials only, at explicit user direction — never response data or respondent identifiers

User-supplied LLM providers

Optional AI features, using credentials the user provides and controls

Only the content the user directs to the provider

Change Notice

We'll tell you before this list changes.

Domandata will update this page at least 30 days before engaging a new sub-processor to process customer or respondent data. If you have questions about a specific vendor or need documentation for a vendor security review, reach out directly.

security@domandata.netBack to Trust Center