Security and privacy

How data is handled #

• Your browser: all data parsing, tabulation, and analysis happen locally. Raw survey data stays on your machine.
• Recense servers: handle authentication, billing, encrypted storage, cloud dataset catalog metadata, the built-in agent, and enterprise hosted compute for explicitly published datasets.
• Remote raw-data access is not available in the hosted product.

Encryption #

• Local projects: optional encryption for exported .recense files.
• Cloud projects: encrypted on your machine before upload. The server stores only encrypted data.
• Cloud datasets: encrypted on your machine before upload. The server stores ciphertext plus catalog metadata needed for your organisation to browse them.
• Cloud encryption modes: by default (convenience mode) your keys are wrapped under your login password and Recense can technically decrypt cloud data to provide cloud features. Turn on zero-knowledge mode in Settings → Encryption & keys to wrap your keys under a passphrase only you hold — Recense then cannot decrypt your cloud data (the passphrase is unresettable; you keep a recovery-key file).
• In transit: all connections over HTTPS.
• API keys (BYOK): stored in your browser, encrypted at rest. If you choose to save a key to your account, it is end-to-end encrypted with your login password before upload.

What the server sees #

Survey responses / raw data

Not in plaintext for the standard cloud dataset library. Enterprise hosted compute processes only datasets your organisation has explicitly published, and remote raw-data access remains disabled.

Variable names, labels, structure

Local-first by default. Hosted semantic variable search sends variable names, labels, and selected value labels to OpenAI only if your organisation enables it.

Cloud dataset catalog metadata

Yes. Dataset names, filenames, formats, sizes, and timestamps stay server-visible so organisation members can browse the library.

Table configurations and canvas layout

In cloud-saved projects (encrypted).

Agent conversations (built-in mode)

Passed to the AI provider. Not stored by Recense in readable form — conversation history is saved only inside your project, which is encrypted if you cloud-save it.

Agent conversations (BYOK)

Requests go directly from your browser to the provider. Conversation history can be saved inside your project.

Account, billing, usage metrics

Yes.

AI and your data #

• BYOK mode: your browser calls the AI provider directly. Recense servers are not in the path.
• Built-in mode: requests go through Recense to the AI provider, and only after you have activated the hosted agent (Settings → Hosted agent). Conversation content is not stored by Recense in readable form.
• Verbatim text: the agent can read samples of respondents' open-ended answers only if you opt in (Settings → Data & residency → Share verbatim text with AI). It is off by default, and any doubt about your choice — no account, a failed lookup — is treated as off.
• Canvas images: sending images of your canvas to the AI for visual review (Canvas Vision) is off by default. It needs both your own opt-in (Settings → Data & residency) and your organisation allowing it (Settings → Organization privacy).
• MCP mode offers two paths: the browser relay for live-session context, and enterprise hosted compute for explicitly published datasets.
• Hosted semantic variable search is optional. When enabled by an organisation admin, variable names, labels, and selected value labels are sent to OpenAI to build embeddings.
• AI training: Recense does not use your data for AI model training. This is explicit in the privacy policy.

Compliance #

• GDPR: lawful basis documented per processing activity. Data subject rights requests (access, deletion, portability) are handled by email.
• CCPA/CPRA: California privacy rights supported.
• Cookies: only session cookies. No analytics or tracking cookies.

Work-local mode #