Security isn't a checkbox for us — respondent data, campaign attribution, and account credentials all sit on this platform. Here's how we protect them.
Last updated: April 19, 2026
In transit. All traffic to AnimationFunnel uses TLS 1.2 or higher, with HSTS enabled on the marketing site, app, and hosted forms. Internal service-to-service traffic runs over private networks or mutually-authenticated TLS.
At rest. Databases, backups, and object storage are encrypted with AES-256. Secrets and API keys are stored in a dedicated secret manager with per-environment scoping.
Primary infrastructure runs on managed cloud providers inside the EU. Workloads run in isolated virtual networks with strict security group rules. Hosts are immutable and rebuilt frequently from versioned images; no SSH into production except through a break-glass audited proxy.
We log authentication events, admin actions, access to production systems, and all API calls. Logs are stored in an append-only system with retention aligned to our compliance needs. Anomalies (brute-force login attempts, suspicious exports, unusual API patterns) page the on-call engineer automatically.
Databases are backed up continuously with point-in-time recovery. Backups are encrypted and stored in a region separate from the primary. We test restore procedures on a scheduled cadence — a backup you've never restored is not a backup.
We never see or store full card numbers. Payments are handled by Stripe via Stripe Elements / Checkout, and our systems only receive a token and last-4 digits. That puts us in PCI DSS scope SAQ-A.
We design the platform to support our customers' GDPR and other regional data-protection obligations: we publish a sub-processor list, sign Data Processing Agreements on request, and support data export and deletion from the dashboard. For compliance questions, email [email protected].
We review the security posture of every sub-processor before adoption — SOC 2 or equivalent attestations, encryption posture, data residency, and incident history. We re-review annually.
If you believe you've found a security vulnerability, please report it to [email protected]. We ask that you:
We acknowledge reports within one business day and commit to keep you updated through remediation. We don't currently pay cash bounties, but we do credit researchers (with your permission) on our security acknowledgements page.
We maintain a written incident response plan with defined severity levels and owners. In a confirmed security incident affecting customer data we will notify affected workspaces without undue delay — and, where applicable, the relevant supervisory authority within the statutory deadline (72 hours under GDPR, or the relevant regional regime).
Security reports: [email protected]. General security questions or compliance requests (DPA, sub-processor list, questionnaires): [email protected].