Security, built in.
Heurista is designed for research data that needs access controls, auditability, clear AI data handling, and documentation procurement teams can review.
Procurement review
Heurista is operated by Development Institute LLC, doing business as Heurista. If you're evaluating us, email [email protected] for a security overview, questionnaire responses, and our DPA for your procurement process.
Data hosting & residency
Hosting and residency requirements should be confirmed during contracting. The current production architecture uses the providers and regions below.
| Component | Provider | Region |
|---|---|---|
| App (app.heurista.ai) | Fly.io | United States |
| Postgres database | Supabase | Region confirmed during contracting |
| Object storage | Tigris (S3-compatible) | United States |
Need residency confirmed in writing for GDPR or federal contracting? Ask during contracting and we can document the agreed hosting arrangement.
Security controls
TLS encryption in transit
All traffic (participants, app, infrastructure) encrypted in transit using current TLS.
Encryption at rest
Database and file storage encrypted at rest (Supabase Postgres and Tigris object storage).
Role-based access control
Owners, members, reviewers, external collaborators, each with granular permissions. Scope studies to specific people.
Personal API tokens
A user may create personal API tokens to let software they control, including AI assistants, act on their behalf through Heurista’s API. A token acts only with the creating user’s own permissions, within one organisation, and can never exceed them: it cannot carry administrator rights, manage accounts, billing or team membership, or delete data. Tokens are limited to read or read-and-write access, may be restricted to specific studies, expire after at most 90 days, and can be revoked at any time by the user.
Audit logs
Every action that changes state is logged: who did it, when, what changed.
Authentication
Email and password with hashed credentials (scrypt) and session expiry. SSO on Enterprise.
Backups & recovery
Daily automated backups with point-in-time recovery on production databases. Sensitive deletes also land in internal archive tables before being purged.
AI data handling
Heurista uses LLMs from established AI providers for qualitative coding suggestions, Hue study queries, and report drafting. Data flows to those providers under commercial API agreements, not consumer terms.
No training on your data
Your study data and Hue conversations go to AI providers under commercial API terms, not consumer terms. They’re not used to train public models. The current providers and their data terms are in the AI Disclosure.
Grounded, not generative
Hue and the qualitative coding assistant work on your study data. AI-assisted findings are designed to stay close to the response, transcript, or document they came from so reviewers can check the source.
Human-led
You accept, edit, or reject AI suggestions. Codebooks, themes, and report drafts stay under your control, and Heurista records who approved what and when.
Which providers, what they get, and how your data stays separate, all in the AI Disclosure.
Sub-processors
We use a handful of sub-processors to run the app. Categories below; the live list, including AI providers and their terms, is in the DPA.
| Category | Purpose |
|---|---|
| Cloud hosting | App runtime (Fly.io), database (Supabase), file storage (Tigris) |
| AI / LLM providers | Qualitative coding, Hue, report drafting, under commercial API terms |
| Email & support | Transactional email, account notifications, support replies |
| Payments | Subscription billing and invoicing |
| Analytics | Aggregated product analytics, no PII or research content goes through |
See the Data Processing Addendum for the live list and contractual terms.
Compliance & privacy
- GDPR. We support data subject rights, access, deletion, portability, rectification. Residency commitments should be confirmed during contracting. See the Privacy Policy.
- CCPA / CPRA. California residents use the same data subject request channel.
- DPA. A standard Data Processing Addendum is available for customers who need one.
- Acceptable use. What you can and can't do with Heurista is in the Acceptable Use Policy.
Research-specific protections
Research workflows carry obligations regular SaaS doesn't. Heurista is built around them.
- Consent screens. Show participants consent text before they answer anything.
- Participant identifiers. Collect responses anonymously, or with identifiers. Either way, the data sits behind the same access controls.
- Export and deletion. Export full study data or delete responses/studies whenever. Deletes hit audit logs. On the most sensitive tables, deleted rows also land in internal archive tables for forensic recovery before they're purged on schedule.
- Methodology integrity. Audit logs help show reviewers that a researcher reviewed the AI-assisted work.
Reporting a vulnerability
Found something? Email [email protected]. We'll reply within two business days. Please don't test against production accounts you don't own.
Need a DPA, security overview, or questionnaire response?
A signed DPA, questionnaire responses, a security overview, or written residency confirmation, tell us what your procurement process needs.