SurveyMonkey Trust Centre

Trust Centre

With enterprise-grade security, compliance and privacy controls, we protect your data like it’s our own, just like we do for 260K+ organisations worldwide.

BENEFITS

Manage your data and keep it safe with SurveyMonkey

✔ Dedicated security team
✔ Annual third-party penetration tests
✔ Biannual privacy and security reviews
✔ 24/7 on-call security incident response team
✔ Encryption at rest (AES-256) and in motion (TLS 1.2)
✔ Active vulnerability reporting programme
✔ AWS cloud security
✔ Annual security awareness programmes for all employees and contractors
✔ Annual exec-level tabletop exercises

✔ Privacy by design
✔ Biannual audit for privacy compliance
✔ Data breach notification
✔ Customer control of data
✔ AI governance
✔ Standard Contractual Clauses (SCCs) by default
✔ Data Privacy Framework (DPF) self-certified
✔ Robust privacy impact assessment processes

✔ SOC 2 Type II
✔ ISO 27001
✔ CCPA
✔ HIPAA**
✔ PCI DSS
✔ GDPR (EU, UK, Switzerland)

**BAAs available as an add-on with the Enterprise plan; must be purchased separately

✔ Single Sign-On (SSO)*
✔ Two-factor authentication (2FA)
✔ Account control*
✔ Data deletion on a self-service basis or upon request

*Available to SurveyMonkey Enterprise only

SECURITY

Protect your data with best-in-class security

You need a survey platform that you can trust when it comes to sharing your sensitive data. That’s why SurveyMonkey delivers a comprehensive security programme that safeguards your data at every level: from secure product development and employee training to robust global infrastructure management. We undergo regular third-party audits and security reviews to stay ahead of potential threats, ensuring that your data remains protected at all times.

Enterprise-grade security features

Security-first product development

We take a security-first approach to building and maintaining our platform. Every product developer is trained in secure web application development practices when hired and completes annual refresher training to stay up to date with best practices.

24/7 monitoring and rapid response

Security threats don’t keep business hours, and neither do we. Our dedicated incident response team operates 24/7, conducting annual independent penetration tests and running a vulnerability reporting programme to proactively identify and address vulnerabilities.

Enterprise-grade encryption and secure cloud storage

We protect your data with AES-256 encryption at rest and TLS 1.2+ encryption in transit. Customer data is securely stored on AWS servers in the US, Canada and Ireland (EU), ensuring compliance with regional data protection standards.

PRIVACY

Built-in privacy features for peace of mind

SurveyMonkey is built with privacy at its core, so you can collect insights with confidence. Our platform includes built-in features to help you meet GDPR (EU, UK and Switzerland) and CCPA requirements effortlessly. We stay ahead of evolving regulations with ongoing updates, so your data continuously remains protected and compliant.

Learn more

A map of the world with markers placed on the west coast of the United States, the east coast of Canada and Ireland

Secure international data transfers

We are self-certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF Principles, ensuring strict adherence to privacy standards for cross-border data transfers. We also embed Standard Contractual Clauses (SCCs) in our customer and vendor contracts. See our Transfer Statement for more details.

Regional cloud storage options

Our AWS-based data centres in Ireland (EU), Canada and the US give Enterprise users control over where their data is stored. Whatever the storage location, our privacy and security settings ensure compliance with data protection regulations in regions such as Australia, Canada, the UK, Switzerland and the EU.

Control over your data

We provide flexible data retention and deletion controls that align with your local regulatory requirements. With SurveyMonkey, you benefit from strong privacy defaults, intuitive controls and the flexibility to manage your data on your own terms.

Badges showing HIPAA compliant, SOC II compliant, ISO 27001 certified, GDPR compliant and PCI DSS compliant

CERTIFICATIONS & STANDARDS

Simplify how you stay compliant

With certifications such as SOC 2, PCI, ISO 27001 and biannual privacy audits, SurveyMonkey doesn’t just claim security; we get independent third parties to verify and validate it. Our commitment to compliance is validated by rigorous external assessments and industry-recognised standards, so you can rest assured that your data is always protected.

Download GDPR white paper

Industry-specific compliance features

All SurveyMonkey plans include PCI DSS certification. Enterprise customers can also opt for HIPAA compliance or our Enhanced Sensitive Data Protection.

Comprehensive third-party audits

SurveyMonkey has been ISO 27001-certified since 2019 and SOC 2-certified since 2021. We undergo annual audits to ensure that our security controls are consistently met and continuously improved.

Dedicated Data Protection Officer (DPO)

To ensure ongoing compliance and privacy maturity, we have an internal Dedicated Data Protection Officer (DPO) and work with an auditor to ensure that we’re meeting GDPR requirements and adhere to industry best practices.

RESPONSIBLE AI

Leverage product capabilities rooted in responsible and trustworthy AI

We built innovation and security into our AI capabilities, so you can benefit from the power of AI without compromising your data. Our partnerships with third-party providers are such that you can be confident your data will never be used to train their models, thus keeping your information safe, private and fully under your control.

Learn more

A screenshot of a user enabling AI and machine learning features within SurveyMonkey

Minimising data use for maximum privacy

We prioritise privacy by minimising data use, using de-identified data when building and training our machine learning proprietary models. Several AI features use OpenAI or third-party providers to generate insights. Data shared with them is not used to train their AI models.

Manage and control your team’s AI access

Admins on Team and Enterprise plans can manage AI feature access for several AI-powered features such as Build with AI, Response Quality and Sentiment Analysis to ensure that teams use AI in a way that aligns with their company policies.

Ensure compliance with evolving AI regulations

Our AI policy, risk assessment and management processes are built to align with emerging legislation, including the EU AI Act, so you can confidently use AI while staying compliant.

“SurveyMonkey checked off two buy-in factors: SurveyMonkey understands GDPR. SurveyMonkey gets Salesforce. That’s huge for us.”

Matt Schoolfield
Senior Manager of Commercial Analytics and Voice of the Customer
Greyhound

Explore more security and privacy resources

An icon of Goldie, the SurveyMonkey mascot, in a security badge icon

Legal Centre

Find information about privacy, security, terms of use and other important legal topics.

Learn more

SurveyMonkey and GDPR: How we are helping customers stay compliant

Privacy white paper

See how we prioritise compliance and protect your data.

Download now

A woman typing on a laptop next to a padlock icon

Security white paper

Get an in-depth look at how we safeguard your data with industry-leading security practices.

Download now

FAQs

Is SurveyMonkey GDPR compliant?
Yes, we comply and help our customers comply with the General Data Protection Regulation (GDPR) applicable in the European Union and with similar rules in regions such as the UK and Switzerland. We have implemented a variety of measures to ensure that we meet the requirements of the GDPR. This includes features such as data encryption, secure data storage in our EU-based data centre and robust privacy controls. We also provide tools that allow you to manage consent, data access and data retention, helping you remain compliant.
Is it safe to use SurveyMonkey?
Yes, SurveyMonkey is safe to use. We have implemented multiple levels of security controls to ensure that your data is kept safe and secure, including security-enhancing product features such as SSO and multi-factor authentication technology. We also incorporate intrusion protections systems, data leakage prevention tools and vulnerability reporting programmes.
SurveyMonkey is also compliant with ISO 27001, SOC2 and PCI-DSS.
Where does SurveyMonkey store data?
SurveyMonkey data centres operate within a cloud-based architecture powered by Amazon Web Services (AWS), with locations in Ireland (EU), Canada and the United States. Enterprise users can select the physical location for the storage of some of their data. Regardless of where your data is stored, our privacy and security settings ensure compliance with data protection regulations in regions such as Australia, Canada, the UK and the EU.
Can I use SurveyMonkey to collect sensitive data?
Can I use SurveyMonkey to collect protected health information (PHI)?
Is my data used to train AI models?
We use a privacy-by-design and data minimisation-first approach. Following industry practice and consistent with our Privacy Notice, we use de-identified customer data or synthetically generated data to train and build our proprietary AI models while also protecting customer security and privacy.
We have spent many years developing a secure methodology for safely and securely improving our models with minimal invasiveness or human review. This involves a thorough automated method for aggregating and de-identifying data prior to use for model training. We exclude personal data from these data sets and we set strict retention limitations on all data used for this purpose, ensuring that it is deleted within a set time period after use. We also apply strict access controls for data, such that least-privilege rules apply.
Several AI features use OpenAI or other third-party providers to generate insights. Data shared with these third-party providers is not used to train their AI models.
How does SurveyMonkey encrypt data?
SurveyMonkey encrypts all data at rest in our data centres using AES-256-based encryption. Additionally, SurveyMonkey encrypts all data in motion using (i) RSA with 2048-bit key length-based certificates generated via a public Certificate Authority, for communications with entities outside SurveyMonkey data centres; and (ii) RSA 256 certificates generated via Internal Certificate Authority, for all the data within the data centre.
Does SurveyMonkey undergo an external penetration test?
Which security certifications does SurveyMonkey have and maintain?
How do I fulfil Data Subject Requests (DSRs?)
Do you sell my data or my respondents’ data?
Which third-party vendors have access to my data?
Does SurveyMonkey have processes in place to ensure continuous compliance with local and international privacy and security regulations?
Which transfer mechanisms do you rely on when data crosses borders?
SurveyMonkey relies on Standard Contractual Clauses for international data transfers, including appropriate technical and organisational measures to protect EEA, UK and Swiss personal data during and after transfer.
We have also self-certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF Principles, ensuring that we adhere to strict data protection standards when handling customer data.

Please see our EU Data Transfer Statement for more information.
Does SurveyMonkey comply with the Australian Privacy Act to include recent reforms?
If you are an Australian customer, you enter into a contract for SurveyMonkey services with our Irish entity, SurveyMonkey Europe UC. SurveyMonkey Europe UC complies with laws applicable to it in Ireland and the European Union to include the General Data Protection Regulation (GDPR). However, we have taken steps to ensure that our contract terms, data protection and security controls are more broadly compatible with laws that are of concern to our customers where possible. This includes implementing transparent privacy notices, user controls in our products/privacy by design, industry-standard technical and organisational security measures to protect data and ethical AI development and governance practices. We also have an Australia addendum to our DPA which is available for our Australian customers.

Want to learn more?

Contact our sales team and get answers to all your security and privacy questions plus access to specific resources. Note that certain documents may require an NDA on file.