Security

Security & Trust at User Intuition

Last updated: October 2026

TL;DR

User Intuition is an AI-moderated research platform built to clear enterprise security review. User Intuition complies with GDPR, CCPA, and applicable US state privacy laws, encrypts customer data in transit and at rest, and stores all data in the United States (US-East, Ohio), retains it for the duration of the customer relationship, and deletes it within 30 days of account closure or on request. User Intuition's SOC 2 Type II examination is underway — a SOC 2 engagement letter is available on request under NDA — and every User Intuition sub-processor is already SOC 2 Type 2 certified. User Intuition does not train AI models on customer data and does not sell it.

For teams whose security or procurement rules block new SaaS tools, User Intuition also offers fully managed research: you send a brief by email, User Intuition runs the study, and you receive transcripts, reports, and deliverables by email or secure link — without creating an account or granting platform access.

Engagement evidence, control inventory summaries, and readiness assessment status are available under NDA — contact security@userintuition.ai.

Run a study without creating an account

Some teams can't adopt a new SaaS tool until it clears a full security review, and that review can take months. If you'd rather not wait, User Intuition offers fully managed research with no account and no login. You send your research brief by email to managed-research@userintuition.ai, we design and run the study, and you receive the transcripts, reports, and any deliverables you've asked for as an email reply or a secure download link. You never connect your systems, provision an account, or grant standing access — there is nothing on your side to secure or review.

How are client workspaces and stimulus kept confidential?

Isolated workspaces

Every client gets its own isolated workspace. Studies, discussion guides, stimulus, recordings, transcripts and findings live inside that workspace and are not visible from any other, so agencies run one workspace per client and one client's evidence stays in that client's workspace. Inside a workspace, only the people your team invites can see the research. At User Intuition, privileged access to production data is limited to founders and engineering personnel, requires multi-factor authentication and is logged; see access control.

Confidential stimulus

Unreleased stimulus, such as concepts, packaging, ads, prototypes and pricing, is uploaded to the study's workspace and kept confidential. Participants see it only inside their interview, and it is never used to train AI models: every AI sub-processor is barred from training on customer content. Recordings are stored in your User Intuition workspace, the voice provider keeps no copy after the session, and all data is stored in the United States (US-East, Ohio).

This trust center documents how we protect customer data, secure our applications and infrastructure, and respond to incidents. Each section below links to a dedicated page with detail; legal documents are also linked here as a single jumping-off point.

Compliance & certifications

SOC 2 Type II examination underway (independent firm engaged, controls implemented; engagement letter on request). GDPR, CCPA, US state privacy laws today; HIPAA third-party assessment underway.

→

Data protection

Encryption in transit and at rest, US data residency, retention for the life of your account, deletion on request.

→

Application security

SDLC, OWASP Top 10, dependency scanning, static analysis, mandatory code review.

→

Infrastructure

Hosting on Railway and Supabase in US-East (Ohio); business continuity and disaster recovery.

→

Access control

Customer auth via Clerk (MFA, SSO); internal access with MFA, least privilege, quarterly reviews.

→

Incident response

24-hour breach SLA, vulnerability remediation timelines, RFC 9116 security.txt for researchers.

→

AI governance

No training on customer data, prompt-injection defenses, recording consent, participant PII protection.

→

Privacy policy

How we collect, use, retain, and protect personal data — for visitors, customers, and participants.

→

Terms & conditions

Master agreement governing use of User Intuition services.

→
FAQ

Common security questions

User Intuition is not yet SOC 2 certified. We have engaged an independent SOC 2 attestation firm, implemented the SOC 2 control set, and our SOC 2 Type II examination is underway. A SOC 2 engagement letter, control-inventory summaries, and current status are available under NDA via security@userintuition.ai. We comply with GDPR, CCPA, and applicable US state privacy laws today, and all of our sub-processors maintain SOC 2 Type 2 certification. Detailed compliance posture and the sub-processor list are documented at userintuition.ai/security/compliance/.

User Intuition customer data is stored in the United States, specifically the US-East (Ohio) region. Database content, authentication metadata, and application files are hosted by Supabase and Railway, both running in Ohio. The User Intuition marketing website is hosted by Vercel in the United States. We do not transfer customer data outside the United States. All cloud sub-processors are US-based and SOC 2 Type 2 certified.

User Intuition does not use customer data to train AI models. Our AI sub-processors are configured to prevent training on customer content: OpenAI is contractually opted out of training, Google Gemini operates on paid-tier defaults that exclude training, and our voice provider runs in HIPAA-enabled mode which prevents both model training and call retention. We do not sell customer data to any third party.

User Intuition is not a HIPAA-certified entity, and a third-party HIPAA assessment is underway. User Intuition does not currently sign a Business Associate Agreement directly. Our customer authentication provider Clerk and our voice provider both offer HIPAA Business Associate Agreements, and the voice integration runs in HIPAA-enabled mode for all User Intuition assistants, so the voice provider retains no copy of recordings after the session. Recordings are stored in your User Intuition workspace. For healthcare deployments that require a direct BAA with User Intuition, contact privacy@userintuition.ai to evaluate availability under the relevant deployment scope.

Every client gets its own isolated workspace, so one client's studies, guides, stimulus, recordings, transcripts and findings are never visible from another client's workspace, and an agency runs one workspace per client. Only the people your team invites can see the research inside each workspace, and User Intuition's own privileged access is MFA-protected and logged.

Unreleased stimulus such as concepts, packaging, ads, prototypes and pricing stays inside the study's workspace, participants see it only during their interview, and no AI sub-processor may train on it. Recordings stay in your workspace, the voice provider keeps no copy after the session, and all data stays in the United States (US-East, Ohio).

User Intuition follows a documented incident response plan governed by our Threat and Incident Management Policy. We commit to notifying affected customers within 24 hours of confirmed breach detection, aligned with GDPR Article 33. Suspected security issues can be reported to security@userintuition.ai. Our coordinated vulnerability disclosure timeline is 90 days from confirmed receipt. Vulnerability remediation timelines range from 24 hours for critical findings to 90 days for low-severity issues.

User Intuition retains customer account data for the duration of the active relationship and deletes it within thirty (30) days of account closure, unless law requires longer retention (for example, litigation hold). Participant transcripts follow the same lifecycle. Our voice provider runs in HIPAA-enabled mode and does not retain recordings after the session. Customers may request deletion at any time by emailing privacy@userintuition.ai.

Yes. For teams whose security or procurement requirements block new SaaS tools, User Intuition offers fully managed research with no account and no login required. You send a research brief by email to managed-research@userintuition.ai, User Intuition designs and runs the study, and you receive transcripts, reports, and requested deliverables by email reply or a secure download link. You never connect internal systems, provision an account, or grant standing platform access.