Buyer Trust Pack
What a reviewer needs to know about AI Adoption Pulse, on one page. Each statement matches the published Data Processing Addendum and Privacy Notice, which are the binding versions.
Behaviture s.r.o. · IČO 30057965 · Roháčova 145/14, 13000 Prague 3, Czech Republic
Certifications
Behaviture holds no security or privacy certification today: no SOC 2 report and no ISO/IEC 27001 certificate. This page, the Data Processing Addendum and the Privacy Notice describe the controls that are in place instead.
Privacy architecture
- Survey answers are stored without a name, email, account or invitation reference. The link between an invitation and the answers is severed when the survey is submitted.
- Group results appear only for groups of at least 8 people by default, and the minimum can never be set below 5. Smaller groups, and filter combinations that could isolate a person, are withheld.
- Each employee’s coaching report is private to that employee. Company administrators cannot see individual answers, scores or reports.
- Scores come from versioned, deterministic rules. Where a language model helps phrase report text, it receives only minimized aggregate data from groups above the threshold: never names, emails, tokens or small-group data.
Where data is stored
The service runs on Google Cloud in the europe-west1 region (Belgium): the application, the database, report files and secrets. The website itself is delivered through Firebase Hosting’s global CDN from an EU origin.
Where a subprocessor processes data outside the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision.
Subprocessors
- Google Cloud (Cloud Run, Cloud SQL, Cloud Storage, Secret Manager)
- Purpose: Hosting, database, report files and secrets
- Location: EU: europe-west1 (Belgium)
- Google Firebase Hosting
- Purpose: Delivery of the website and app files
- Location: Global CDN, EU origin
- Google Identity Platform
- Purpose: Optional single sign-on for company administrators
- Location: Per Google’s terms
- Google Gemini API
- Purpose: Optional phrasing of aggregate report text; minimized data from groups above the threshold only
- Location: Per Google’s terms for the API
- Resend
- Purpose: Survey invitations, reminders and notifications by email
- Location: Per the provider’s terms
- Stripe
- Purpose: Online payments. Behaviture does not store card data
- Location: Per the provider’s terms
Customers get 30 days’ notice before a subprocessor is added or replaced, and may object on reasonable data-protection grounds.
How long data is kept
- Survey responses, scores and reports
- Until the customer’s data is deleted under the DPA. At the end of the contract it is deleted or returned within 30 days, at the customer’s choice. Responses already severed from any identity, and aggregate data, may be kept.
- Product-analytics events and report-feedback comments
- Deleted automatically 90 days after creation by a scheduled purge
- Application logs
- Deleted after 10 days by a daily purge; other operational logs are kept at most 90 days
- Account and billing records
- For the life of the account, plus the period the law requires records to be kept after closure
- Backups
- Automated database backups with point-in-time recovery, on Google Cloud’s standard retention window
Security measures
- Encryption in transit for all traffic.
- Session, invitation and result tokens are stored only as keyed hashes; raw tokens are never stored.
- Role-based access control, with tenant isolation checked on the server for every organization-scoped query.
- Secrets held in a managed secret store, never in the database and never logged.
- Audit logging of privileged actions, including time-limited read-only support sessions.
- Rate limiting and abuse controls.
- Automated database backups with point-in-time recovery, and a documented incident-response process.
Contract documents
Read them before signing. The Data Processing Addendum is a binding Article 28 GDPR contract and is accepted with the terms when a workspace is created.
Security contact
Security questions, questionnaires and data-protection requests: privacy@behaviture.com
If a personal-data breach affects customer data, Behaviture notifies the customer without undue delay.