How we protect the feedback firms trust us with.

Client feedback data – survey responses, verbatim comments and consent records – is stored and processed in Sydney, Australia: the database in AWS ap-southeast-2 and application compute in the Sydney region. Ancillary sub-processors and their regions are disclosed in full below.

• At rest: AES-256 at the database platform (database instances via AWS KMS; object storage via SSE-S3).
• In transit: TLS 1.2 or higher for all connections – browser to platform, platform to database, and platform to our email provider.
• Sensitive stored credentials such as SSO client secrets are encrypted at the application layer with AES-256-GCM.
• Backups are encrypted on our side before they are stored; the storage provider holds ciphertext only.

• Firm users authenticate through enterprise single sign-on (Microsoft Entra ID). No local passwords for SSO-enforced firms.
• For SSO-enforced firms, sign-in is refused at domain level for any non-approved identity provider.
• No automatic account provisioning: only staff a firm has deliberately loaded onto the platform can sign in.
• Every platform query is firm-scoped, isolating each firm’s data. Within a firm, access is scoped by role, office and team.
• Multi-factor authentication is required on the administrative consoles we operate, including the database platform at organisation level.
• Least privilege: single-purpose service credentials, and administrative and impersonation actions are audit-logged.

• Rate limiting on public submission, authentication and expensive operations.
• Request bodies validated with typed schemas at the route boundary; type-safe, parameterised database access throughout – no raw SQL.
• CSRF protection on every mutating route (origin check plus a custom-header challenge) and host-bound session cookies.
• Server-side outbound requests pass an egress guard that restricts where the platform will connect.
• Survey links use unique, expiring tokens; submissions carry honeypot and datacentre-IP bot protection.
• SPF and DKIM authentication on our sending domain; an opt-out link in every survey email, honoured permanently.

Most of the platform uses no third-party AI at all: dashboards, trend charts, benchmarks and longitudinal reports run on structured data we hold ourselves.

Two features use an AI provider, and Anthropic is the sole AI processor for both, under an enterprise data processing agreement with no training on our data.

• Custom Reports commentary. When a Client Culture analyst drafts a report, the platform sends the firm’s aggregate results for the period – loyalty-driver profile, theme labels, office, division and industry segment names, and a kudos count – and receives draft commentary. The firm’s own name is replaced with a neutral reference before sending and resolved only within Client Culture systems. This is the EphemeralAI™ principle, applied to Custom Reports commentary since 12 September 2026. No client names, no professional names and no verbatim feedback are sent. The exchange is operator-triggered and transient: the platform stores nothing from it beyond the draft.
• Help assistant. A signed-in user’s typed question is sent to the provider with a role prompt. No platform data is attached.

Every AI call is recorded in the audit log with counts only – never content.

AI output is a drafting input, not the deliverable. Every report’s themes, interpretations and recommendations are developed and finalised by Client Culture analysts, who select and attribute quotes from the platform directly.

A path for pseudonymising verbatim content is built and is enabled before any future feature sends verbatims to an AI provider. AI-related claims we publish must match implemented behaviour.

• Each firm configures a retention period for verbatim (free-text) feedback.
• A daily automated process deletes verbatim comments once they pass the firm’s retention period, recording only counts in the audit log – never content.
• The more privacy-protective interpretation prevails: shortening a retention period applies retroactively to existing comments; lengthening it never restores content already due for deletion.
• NPS scores, loyalty driver selections and response metadata (dates and the assigned professional) persist as structured data for trend analysis and contain no free text.
• Expired employee survey invitations are anonymised daily.

• The database platform provides point-in-time restore with a 30-day history window.
• Independently, an automated nightly backup runs on separate infrastructure, is encrypted client-side (the storage provider holds ciphertext only), and is restore-tested on every run against a disposable database with integrity checks. Backups are retained for 30 days.
• Recovery point: near-zero via point-in-time restore; no more than 24 hours if the database provider itself were lost.
• A restore drill was most recently performed on 18 August 2026, winding a copy of production back to a chosen minute and verifying every table. Recovery drills are performed and recorded; decrypt-and-recover drills of the independent backup run quarterly.

• Dependencies are monitored continuously with automated advisory alerting on every production repository.
• Static application security testing and dependency, secret and misconfiguration scanning run weekly and on every change to the main branch of all three production repositories, with reports retained for 90 days.
• Vulnerabilities are triaged by exploitability and reachability against the platform’s authentication middleware and egress controls, not by severity label alone. Accepted risks carry a dated review obligation.

Our security posture is independently assessed by the security teams of the firms we serve, most recently in August 2026 against the NSW Cyber Security Policy framework. Our Information Security Policy is mapped to ISO/IEC 27001:2022 Annex A.

We are not ISO 27001 certified and do not claim to be. Our infrastructure providers hold the certifications listed above, and we hold their reports.

Client Culture operates under the Australian Privacy Act 1988 and the Australian Privacy Principles, and, for firms in the United Kingdom and European Economic Area, UK GDPR and EU GDPR. We act as a data processor on behalf of our firm clients, handling feedback data according to each firm’s instructions and our data processing agreements.