Security at SurveyMint

This page describes controls that are implemented in the application today.

Implemented controls

Account credentials

  • Passwords are hashed with bcrypt before they are stored.
  • New passwords must meet length and complexity requirements.
  • Password-reset and email-verification tokens are random, expire, and are stored as hashes.

Sessions and requests

  • Production sessions use secure, HTTP-only cookies with SameSite protection.
  • Sensitive endpoints apply bounded request sizes and server-side rate limits.
  • Authentication and authorization checks protect account and dashboard routes.

Payments

  • Stripe hosts card checkout; SurveyMint does not collect card numbers in its own forms.
  • Payment events are signature-checked before an order is credited.
  • Order processing uses idempotency controls to avoid crediting the same payment twice.

Data integrity

  • PostgreSQL constraints, transactions, and row locks protect important account, survey, exchange, and billing updates.
  • Exchange participation rules are enforced on the server, including one completion per account and campaign.
  • Application errors are handled without intentionally exposing credentials or database connection details.

Scope and limitations

These controls reduce risk but cannot guarantee absolute security. SurveyMint does not claim SOC 2 or ISO 27001 certification on this page. A feature description is not a substitute for your own security, privacy, or regulatory review.

Protect your account

  • Use a strong password that you do not reuse on another service.
  • Do not share sign-in, verification, or password-reset links.
  • Sign out on shared devices and change your password if you suspect account access.
  • Avoid collecting sensitive information unless it is necessary and lawful for your study.

Report a security concern

Send a concise description, affected page, reproduction steps, and potential impact to hi@surveymint.io. Do not access or alter another person's data while investigating.

Please do not include passwords, session tokens, private survey answers, or other secrets in the initial report.

← Back to Home