Encryption is a method of protecting data from unauthorized access by replacing the contents with unrecognizable data that can only be understood by the intended recipient. There are two main situations where encryption is used: in transit and at rest.

Encryption in transit refers to data that is encrypted while it is being transmitted, such as from a browser to a web server or through third-party integrations. This protects the data from man-in-the-middle attacks.

Encryption at rest (EAR) refers to data that is encrypted when it is stored, such as on a disc or in a database. In addition to encrypting data in transit, EAR provides an extra layer of security by protecting against data leaks due to server compromise or unauthorized access.

In a survey, the following data is encrypted at rest:

• Custom fields in open-ended questions that may contain personally identifiable information (PII) or other sensitive information

• Custom variables in custom field encryption

• Any files uploaded by respondents

• Email addresses provided in the share feature

Encryption in a survey is done at the application layer using the AES-256 algorithm, which is a symmetric encryption algorithm that uses 128-bit blocks and 256-bit keys. The key used to convert the data from plain text to cipher text is called the data encryption key (DEK). The DEK is further encrypted using the key encryption key (KEK), providing another layer of security. The keys are generated and maintained by our out platform providers key management service (KMS).