Security at User Sage

Last Updated: October 19, 2026

User Sage handles research data: what participants said, and sometimes recordings of them saying it. That deserves straight answers about how it is protected. This page is the short version. The privacy policy has the legal detail.

How data is protected

  • All traffic runs over HTTPS. Data is stored with Supabase and Vercel, who encrypt it at rest.
  • Study files and recordings live in private storage buckets. They are reached only through short-lived signed links, never public URLs.
  • Connections you make, like Google Calendar or Tremendous, store their tokens encrypted on our servers.
  • Payments run through Stripe. Your full card number never reaches User Sage.
  • Access inside the team is limited to what a task needs. We look at a workspace's participant data only to fix a problem you have asked us to help with, for security reasons, or where the law requires it.

Your data and AI

  • Your studies and your participants' data are never used to train AI models. Not ours, not our providers'.
  • AI Panel results are generated from your study and the simulated panel you set up. No real participant's personal data is used to create them.
  • Real participants' answers are sent to an AI provider only if you ask for an optional AI summary, and then only the answers, never names or email addresses.

Recordings

  • Session recordings are deleted after 12 months. The transcript stays as part of the workspace's research record, and a participant can ask the host to delete the recording and transcript at any time.
  • Copies held by recording vendors are deleted after each session.

Backups and reliability

  • The database is backed up daily to separate storage.
  • Live service status, updated every 15 minutes, is at status.usersage.com.

Deletion that actually deletes

  • A participant can ask for their data to be removed. User Sage carries the deletion out itself: name and email removed, responses anonymized, and the email added to a permanent blocklist for that workspace so it cannot be quietly re-added.
  • Deleting your account deletes your workspace's data with it, as described in the privacy policy.

Security questionnaires

If your organization has a security questionnaire, send it to the contact below and we will fill it in. A data processing addendum is also available on request.

Reporting a security issue

Found something? Email security@usersage.com with what you found and how to reproduce it. We read every report and respond. Please give us a reasonable window to fix an issue before disclosing it publicly.

Subprocessors

These services process data on our behalf, each limited by contract to that purpose.

  • Clerk: sign-up and account sessions
  • Stripe: payments and subscriptions
  • Supabase: database and file storage
  • Vercel: hosting
  • Google, OpenAI, Anthropic, and providers of open AI models, accessed directly or through Vercel: AI processing for AI Panel results and optional summaries
  • Prolific: GenPop Panel recruiting and participant payment
  • Tremendous: reward delivery, for workspaces that connect it
  • Sentry: error monitoring (technical details, not study responses)
  • Brevo and HostGator: email delivery
  • PostHog: product analytics in the signed-in app
  • Google Analytics: marketing site traffic
  • Cloudflare: bot protection on public forms and backup storage
  • Figma, Google Calendar, and AI tools you connect through MCP: only when a customer connects them, scoped as described in the privacy policy