Security and Data Handling

SOC 2 and data protection

Our SOC 2 program is in progress. We are targeting October 2026 for a Type I report and January 2027 for a Type II report. Neither report has been issued. These are target dates.

A Type I report assesses controls at a point in time. A Type II report also assesses how those controls operate over a defined period.

Our DPA sets out our data protection obligations, including transfer requirements and California service-provider terms.

Processing location

Customer data is hosted and processed in the United States. For international transfer terms, see DPA Section 10.

Hosting and infrastructure

The application runs on Render. Microsoft Azure hosting is planned and is not currently used for production customer data.

Data is encrypted in transit using TLS and encrypted at rest. Production access is limited by role, logged, and revoked when personnel leave. Access permissions are reviewed regularly.

AI and voice processing partners

Inworld provides conversational AI, speech recognition, and voice processing. Anthropic provides AI analysis of interview content. Provider details and processing locations are listed in DPA Annex III.

Neither Bigfoot nor its sub-processors may use Customer Data to train, retrain, or fine-tune AI models. This restriction is set out in the Terms and DPA.

Interviews and findings

• Participants are told they are speaking with an AI interviewer, what the study is for, and that they can stop at any time.
• A Bigfoot analyst reviews findings before delivery, using redacted transcripts.
• Findings can be incomplete or inaccurate. Customers are responsible for reviewing them before acting.
• Our Terms prohibit using outputs to make decisions about individual participants or attempting to re-identify participants.
• Participants are asked not to share sensitive information such as health details or religious beliefs. If disclosed, this information remains protected and is excluded from deliverables.

Data access and handling

Bigfoot analysts review transcripts with names and other direct identifiers removed. Findings are reported in aggregate unless a different format is agreed in writing for a specific purpose. Redacted or aggregated information may still identify someone from context; we continue to protect it as personal data when it does.

Personnel authorized to process customer data are bound by confidentiality obligations.

The default retention period for raw interview data ends within 30 days after the final deliverable is accepted or the engagement ends, whichever comes first. The DPA sets out return and deletion terms and exceptions. See DPA Section 13.

Responsible disclosure

To report a suspected vulnerability, email privacy@bigft.com with the affected page or service and steps to reproduce the issue. Please avoid including customer data in the report.

Incident response

Bigfoot maintains a documented incident response process. In the event of a personal data breach affecting customer data, we notify the affected customer without undue delay and within 72 hours of becoming aware of it, consistent with our Data Processing Agreement.

Governing documents

The DPA describes the handling of personal data. The Terms and Conditions cover the engagement.

Questions

For security questions, questionnaires, or requests for supporting documents, contact privacy@bigft.com.