Security and data protection
A Delphi panel collects what people actually think — material that deserves careful handling. This page tells you where the material is, who sees it, what the AI does and what it does not. The formal notice is separate; this is its readable version.
What this page is
This page describes how the service works, not what it commits to. The binding terms are in the privacy notice and in the data processing agreement (DPA), which is made separately with an organisational customer. If this page and the notice disagree, the notice wins — and that is a mistake we want to hear about.
Where the material is
The service runs on a server located in the EU, and backups stay within the EU; they are kept for at most 30 days. The database is part of the server rather than a separate cloud database service. Material is not sold or handed on, and it does not leave the service by default — with two exceptions: the AI features (see below) and an export the facilitator makes themselves.
Who sees what
Panelists see each other only as neutral word pseudonyms (such as Vega), never as names. Roles are per study — owner, facilitator, viewer — and a viewer never receives personal data: the right to read results is not a right to the people behind them. A sensitive panel can be run blind, which hides names and addresses from the facilitator as well. Exports and the handoff to analysis always use the pseudonym: the name does not leave the service even when the facilitator can see it.
Access, accounts and the trail
Everyone running a study has a personal account — shared credentials are not used, because with a shared account you cannot tell afterwards who did what, and you cannot remove access from one person at a time. Administrator rights require two-factor authentication, because they open the material of every study. Users see their own sessions and can end them. Every change to access rights is written to an immutable rights history in the same transaction as the change itself. A panelist's invite link is personal and reusable, but it expires and can be revoked.
AI in the panel: three levels
AI use is chosen per study. At level off the AI is not used at all and nothing is sent to an AI service. At level assist — the default for new studies — the AI helps only the facilitator with method questions, and nothing panelists have written leaves the service. At level full the features that use panel content come along: AI panelists, Round 0 conversations and coding suggestions. Beyond that, the whole service can be run without AI: with no API key every AI feature degrades cleanly to a rule-based mode.
What goes to the AI — and what does not
AI calls contain no panelist name and no email address — only the pseudonym and the content. The material is not used to train AI models. The presence of AI panelists is disclosed to panelists before they respond, and AI-generated content is marked: an AI panelist's name always takes the form AI · role, alongside the 🤖 marker. The marker does not stop at the interface: it travels as a machine-readable field into the analysis and the exports, so human and machine speech cannot be confused after the fact. The cost of AI is shown per study, and you can set your own ceiling.
Deletion and anonymization
Studies, panelists, theses and comments can be deleted, and so can a user account. When a study ends the facilitator anonymizes the material: names, addresses and invite links are permanently deleted, and what remains is anonymous research data. Two things are kept on purpose — the rights history and the AI usage records. Neither names the deleted person by address, and each has its own reason: the duty to show who has had access to the material, and bookkeeping.
The limits, said out loud
A security page that promises everything mostly tells you what has not been measured. These are the known limits today.
How we know the promise holds
Every promise on this page lives in code, and code changes. So each promise has a guard: an automated test that goes red when the promise breaks. The guards run on every change, and each one has been tried by breaking the code on purpose — a guard that does not go red is not guarding anything. A few of them:
test_identity_leak_coverageEvery route that returns a panelist's personal data passes through the same choke point.test_ai_budget_coverageEvery route that calls the AI is known and books its cost to a study.test_unauth_surface_coverageA visitor without a session gets an answer only from the surface meant to be public.test_panelist_token_coverageInvite-link routes check the token before looking at the request body at all.test_route_scope_coverageEvery study-scoped route checks that the caller belongs to that study.test_prompt_injection_coverageText written by a panelist cannot turn into an instruction to the AI.Need an agreement or an answer?
The data processing agreement, the list of sub-processors and a procurement security questionnaire are all handled from the same address. Ask also when this page does not answer your question — that tells us a section is missing.