Trust Center

In market research, trust is essential. That is why Crowdtech Insights is designed not only for ease of use, but also to meet the highest standards of data security, privacy and compliance. Our Trust Center explains how we protect your data in a transparent and verifiable way, fully aligned with European requirements.

Security

Crowdtech has implemented more than 100 security controls to ensure the availability, integrity and confidentiality of your data, as well as the safety of our systems.

Our core principles:

Security is a top priority: Our Security Officers report directly to the Managing Director and provide monthly updates on progress and incidents, following a defined governance structure. All protocols, procedures and controls are documented in our Information Security Management System (ISMS) in line with ISO 27001:2022.
Your data always stays in Europe: We operate and manage our own servers and do not use cloud storage services such as AWS for hosting client data. Our servers are located in Equinix’s highly secure European data centers (AM5 and AM8 in Amsterdam), meeting the strictest security and compliance standards.
Prevention first: We focus strongly on preventing and detecting potential security incidents at an early stage. This includes the use of a Security Information and Event Management (SIEM) system, a supporting SOC service, PRTG monitoring and a continuous staff awareness programme delivered via Awaretrain.

Infrastructure protected to market standards: Our infrastructure uses industry best practices, including encryption of data in transit (TLS 1.2) and at rest (Microsoft TDE), advanced firewalls with IPS/IDS, filtering, rate limiting and redundant configuration of critical processes.
Internal and external validation: Our operational planning includes all annual audits and penetration tests conducted by Crowdtech. In addition, clients regularly perform ad hoc vulnerability scans, DPIAs and penetration tests on our systems.

Highlighted Security Measures

Single Sign-On (SSO)

Crowdtech Insights supports Single Sign-On through multiple identity providers, including Microsoft Entra ID, eHerkenning and SURFconext. This ensures your organisation’s authentication rules also apply to our platform, enhancing both security and user experience.

Controlled data exchange

Secure, automated data transfer between your systems and our platform is possible via REST API integrations. This reduces errors, increases efficiency and ensures you keep full control over your data, which is only hosted externally for a limited period.

24/7 incident line

In case of an incident, you can contact our emergency line at any time, including evenings and weekends. The Security Officer immediately initiates the applicable procedures and coordinates with the on-duty developer and standby partners to prevent escalation.

Logging

All user and staff actions are logged in detail at an individual level. We maintain a 90-day log history, enabling us to reconstruct who performed which action and when. This ensures we can always provide a complete audit trail when required.

Back-ups

We retain back-ups of client data for three months. If data becomes unavailable due to an issue on our side, we can restore it from a back-up. Users who accidentally delete data can reverse changes within 24 hours using the undo feature in Crowdtech Insights.

Our security partners

Our systems are kept secure with the support of the following organisations.

Infrastructure management

Data center

SIEM

SOC

Endpoint protection

Privacy

Crowdtech has implemented more than 50 privacy controls covering our roles as both Processor and Controller.

Our core principles:

Fully GDPR compliant: As a company founded in the Netherlands, privacy has always been fundamental to our organisation. We were early adopters of ISO 27701 (certified in 2022 through the accredited body DEKRA). Our commitment to privacy is documented in our Privacy Information Management System (PIMS).
Privacy by design: Privacy is built into all our processes and the ongoing development of Crowdtech Insights. Our Data Protection Officer (DPO) is always consulted when new features or changes may impact privacy. The DPO proactively identifies improvements and ensures privacy safeguards are embedded from the start.

Privacy by default We minimise personal data processing wherever possible. Crowdtech Insights includes default retention periods, anonymisation options and export files without personal data.
Transparency in the full ICT chain: We always know what personal data is processed, where and by whom. Crowdtech uses only a limited number of sub-processors, including Microsoft and Spotler. These are outlined in our Data Processing Agreement.
Your data is always your property: We never sell your data, never use it to train AI or similar models and do not use it in test environments.

Highlighted Privacy Measures

Role and access management

Administrators can grant users only the specific permissions needed for their role within the organisation.

Special category data

Crowdtech Insights can process special category data when required. Through mandatory consent steps and respondent opt-out options during surveys, our platform fully meets the regulatory requirements for processing such data.

No metadata processing

The platform processes only the data entered by respondents or users. We use only functional cookies and do not collect identifiable metadata such as IP addresses or geolocation.

Data subject rights

Crowdtech Insights enables organisations to fulfil all GDPR rights for their respondents, including unsubscribing from research, accessing their data and the right to be forgotten.

Support in case of data breaches

Crowdtech acts as Processor and therefore cannot contact authorities or data subjects directly. However, our DPO team fully supports organisations by preparing notifications, communications to data subjects and providing required audit trails.

AI

Cai is Crowdtech's AI, built on more than 20 years of market research experience. With Cai we combine the power of AI with Crowdtech's research expertise, quality standards and security principles.

Our core principles:

Built for research: Cai was built specifically for research. Carefully designed prompts, fixed output structures and built-in quality checks keep results as consistent and reliable as they can be.
You stay in control: You decide whether Cai is used in your organisation and in your research. No AI feature switches itself on; it runs only if you choose it.
Stability: Crowdtech checks all AI output against fixed rules and output structures. Output that does not meet these requirements is not passed on to the user.

Key AI measures

European AI processing

Our AI processing runs through European endpoints only. For detecting and removing personal data we use Microsoft Azure AI Language in the West Europe region. For generative AI we use Mistral through European endpoints.

Zero Data Retention (ZDR)

ZDR is enabled by default. Once your input has been processed, the AI provider neither stores nor retains it.

Personal data stripped before processing

Cai strips direct personal data out before any text reaches the generative AI model, so the model only ever sees cleaned text.

Kept separate per client

Data, prompts and AI results are kept logically separate in each client environment. No other client can access them.

No training on client or respondent data

Client and respondent data is never used to train or fine-tune AI models.

Auditable

Relevant details of every AI run are recorded for monitoring, quality assurance and audit purposes. That lets us establish after the fact which input, prompts and output an AI run used.