Security & Trust
Last reviewed: May 2026
User Intuition is an AI-moderated research platform built to clear enterprise security review. User Intuition complies with GDPR, CCPA, and applicable US state privacy laws, encrypts customer data in transit and at rest, and stores all data in the United States (US-East, Ohio) with a 30-day retention default and deletion on request. SOC 2 Type 1 attestation is in active progress, targeting H2 2026; every User Intuition sub-processor is already SOC 2 Type 2 certified. User Intuition does not train AI models on customer data and does not sell it.
For teams whose security or procurement rules block new SaaS tools, User Intuition also offers fully managed research: you send a brief by email, User Intuition runs the study, and you receive transcripts, reports, and deliverables by email or secure link — without creating an account or granting platform access.
Engagement evidence, control inventory summaries, and readiness assessment status are available under NDA — contact security@userintuition.ai.
Run a study without creating an account
Some teams can't adopt a new SaaS tool until it clears a full security review, and that review can take months. If you'd rather not wait, User Intuition offers fully managed research with no account and no login. You send your research brief by email to managed-research@userintuition.ai, we design and run the study, and you receive the transcripts, reports, and any deliverables you've asked for as an email reply or a secure download link. You never connect your systems, provision an account, or grant standing access — there is nothing on your side to secure or review.
This trust center documents how we protect customer data, secure our applications and infrastructure, and respond to incidents. Each section below links to a dedicated page with detail; legal documents are also linked here as a single jumping-off point.
Compliance & certifications
SOC 2 Type 1 attestation in progress (auditor engaged, controls implemented, readiness assessment underway). H2 2026 target. GDPR, CCPA, US state privacy laws today.
→Data protection
Encryption in transit and at rest, US data residency, 30-day retention, deletion on request.
→Application security
SDLC, OWASP Top 10, dependency scanning, static analysis, mandatory code review.
→Infrastructure
Hosting on Railway and Supabase in US-East (Ohio); business continuity and disaster recovery.
→Access control
Customer auth via Clerk (MFA, SSO); internal access with MFA, least privilege, quarterly reviews.
→Incident response
72-hour breach SLA, vulnerability remediation timelines, RFC 9116 security.txt for researchers.
→AI governance
No training on customer data, prompt-injection defenses, recording consent, participant PII protection.
→Privacy policy
How we collect, use, retain, and protect personal data — for visitors, customers, and participants.
→Terms & conditions
Master agreement governing use of User Intuition services.
→