Skip to navigation
Data & Privacy

Security & Compliance

Typeform AI maintains enterprise-grade security and compliance standards for your data.

Security Framework

Data Encryption

  • In Transit: TLS 1.3 for all data transmission
  • At Rest: AES-256 encryption for stored data
  • AI Processing: Encrypted during analysis
  • Backups: Encrypted and geographically distributed

Access Controls

  • Multi-factor authentication (MFA) required for teams
  • Role-based access control (RBAC)
  • SSO/SAML integration available
  • API key rotation and expiration

Network Security

  • SOC 2 Type II certified infrastructure
  • DDoS protection
  • Regular penetration testing
  • Web application firewall (WAF)

Compliance Certifications

SOC 2 Type II - Annual independent audits, reports available under NDA

ISO 27001 - Information security management certified

GDPR Compliance - EU-US Data Privacy Framework, DPA available

CCPA Compliance - California Consumer Privacy Act compliant

HIPAA - Business Associate Agreements available for healthcare

AI-Specific Security

Model Security

  • AI models hosted in secure environments
  • No cross-account data contamination
  • Version control and rollback capability

Prompt Injection Protection

  • Input sanitization
  • Output validation
  • Rate limiting
  • Abuse detection

Data Isolation

  • Logical separation between accounts
  • Dedicated processing queues
  • No shared training data

Enterprise Controls

Admin Console

  • Centralized user management
  • AI feature governance
  • Usage monitoring and alerts
  • Complete audit logs

AI Governance

  • Enable/disable AI features per workspace
  • Set data processing boundaries
  • Configure retention policies

Third-Party AI Security

All AI providers are SOC 2/ISO 27001 certified with:

  • Contractual data protection terms
  • Zero data retention policies
  • Regular security assessments
  • Data Processing Agreements

Incident Response

  1. Detection and alert (< 15 minutes)
  2. Triage and assessment (< 1 hour)
  3. Containment and mitigation (< 4 hours)
  4. Customer notification (< 24 hours for material impact)
  5. Post-incident review

Regional Data Residency

US Data Center (Default) - AWS us-east-1 EU Data Center (Available) - AWS eu-west-1, GDPR-compliant Custom Deployments - Private cloud for enterprise

Your Controls

Security Best Practices

  • Enable MFA for all team members
  • Use SSO for centralized access control
  • Regularly review audit logs
  • Implement least-privilege access
  • Monitor AI usage patterns

Resources

We maintain transparency and accountability in our security practices.