Security and subprocessors

Overview

ChalkHR Polls & Surveys is operated by SmallCloud Technologies Incorporated. This page is the public summary of where production data lives, who processes it, and how we protect it. The contractual terms for customers who are controllers under GDPR are in the Data Processing Agreement.

We are not SOC 2 or ISO 27001 certified. We will complete reasonable security questionnaires and share the measures on this page.

Hosting locations

Production customer data is stored in the United States. There is no EU or UK region option today.

Production subprocessors

These vendors process personal data to deliver ChalkHR Polls & Surveys in production. We give general written authorisation under the DPA. We will update this list at least 30 days before a new production subprocessor starts processing customer personal data. Object by emailing privacy@chalkhr.com.

Non-production infrastructure

Staging and pull-request preview environments use a separate database. They are not used to host production customer tenants.

Technical and organisational measures

• Encryption in transit — TLS for all public HTTPS endpoints and database connections.
• Encryption at rest — Production database storage is encrypted by the cloud provider (PlanetScale on AWS).
• Tenant isolation — Rows are keyed by Microsoft tenant ID. Application queries are scoped to the authenticated tenant.
• Authentication — Microsoft Entra ID / Teams SSO. We do not store passwords. The Teams app does not require Microsoft Graph admin consent; team and channel lists are fetched with the bot's own credentials.
• Access control — Production access is limited to operators who need it to run the Service. Cloudflare and PlanetScale credentials are stored as secrets, not in source control.
• Logging and errors — Application logs (Axiom) and error reports (Sentry) are used to operate and debug the Service. Sentry events may include user object ID and tenant ID.
• Anonymous polls — Voter names are hidden in the UI. Vote rows still store a user ID so each person can vote once.

Data retention

Poll questions, options, votes, and responses are kept until the poll is deleted by its creator or the organization asks us to delete the tenant. Uninstalling the Teams app removes access; it does not automatically delete stored data.

On written request, or when the agreement ends, we delete customer personal data from production systems within 60 days unless law requires storage, and we can return a machine-readable copy first. Backup copies may persist for up to 90 days in the ordinary backup cycle. The contractual terms are in the DPA.

Incident notice

We will notify the customer organization without undue delay, and no later than 72 hours after becoming aware of a personal data breach affecting that organization's customer personal data, at the email used for the Service or an address the customer designates. Details are in the DPA.

Data Processing Agreement

Organizations that need a GDPR Art. 28 DPA can review and rely on chalkhr.com/dpa. It incorporates the EU Standard Contractual Clauses (Module Two) and the UK International Data Transfer Addendum. To countersign, email privacy@chalkhr.com with your legal entity name and registered address.

Contact

SmallCloud Technologies Incorporated
Ontario, Canada
The registered office address is available on request.
Privacy: privacy@chalkhr.com