> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://typeform.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://typeform.ferndocs.com/_mcp/server.

# Security & Compliance

Typeform AI maintains enterprise-grade security and compliance standards for your data.

## Security Framework

**Data Encryption**

* **In Transit**: TLS 1.3 for all data transmission
* **At Rest**: AES-256 encryption for stored data
* **AI Processing**: Encrypted during analysis
* **Backups**: Encrypted and geographically distributed

**Access Controls**

* Multi-factor authentication (MFA) required for teams
* Role-based access control (RBAC)
* SSO/SAML integration available
* API key rotation and expiration

**Network Security**

* SOC 2 Type II certified infrastructure
* DDoS protection
* Regular penetration testing
* Web application firewall (WAF)

## Compliance Certifications

**SOC 2 Type II** - Annual independent audits, reports available under NDA

**ISO 27001** - Information security management certified

**GDPR Compliance** - EU-US Data Privacy Framework, DPA available

**CCPA Compliance** - California Consumer Privacy Act compliant

**HIPAA** - Business Associate Agreements available for healthcare

## AI-Specific Security

**Model Security**

* AI models hosted in secure environments
* No cross-account data contamination
* Version control and rollback capability

**Prompt Injection Protection**

* Input sanitization
* Output validation
* Rate limiting
* Abuse detection

**Data Isolation**

* Logical separation between accounts
* Dedicated processing queues
* No shared training data

## Enterprise Controls

**Admin Console**

* Centralized user management
* AI feature governance
* Usage monitoring and alerts
* Complete audit logs

**AI Governance**

* Enable/disable AI features per workspace
* Set data processing boundaries
* Configure retention policies

## Third-Party AI Security

All AI providers are SOC 2/ISO 27001 certified with:

* Contractual data protection terms
* Zero data retention policies
* Regular security assessments
* Data Processing Agreements

## Incident Response

1. Detection and alert (\< 15 minutes)
2. Triage and assessment (\< 1 hour)
3. Containment and mitigation (\< 4 hours)
4. Customer notification (\< 24 hours for material impact)
5. Post-incident review

## Regional Data Residency

**US Data Center** (Default) - AWS us-east-1
**EU Data Center** (Available) - AWS eu-west-1, GDPR-compliant
**Custom Deployments** - Private cloud for enterprise

## Your Controls

**Security Best Practices**

* Enable MFA for all team members
* Use SSO for centralized access control
* Regularly review audit logs
* Implement least-privilege access
* Monitor AI usage patterns

## Resources

* [Security Portal](https://security.typeform.com)
* [Trust Center](https://trust.typeform.com)
* [Privacy Policy](https://www.typeform.com/privacy)
* Contact: [security@typeform.com](mailto:security@typeform.com)

We maintain transparency and accountability in our security practices.