Security

Infrastructure

The platform runs on modern cloud infrastructure designed for reliability and security:

• Hosting: Vercel — serverless application hosting with automatic HTTPS
• Database: Neon PostgreSQL — managed relational database with automated backups
• File storage: Vercel Blob — encrypted object storage for user uploads
• Payments: Stripe — PCI-compliant payment processing (we do not store full card numbers)
• Email: Loops — transactional and notification email delivery

Encryption

• In transit: All connections to artificialpopulations.com use TLS 1.2 or higher. API and web traffic is encrypted end-to-end between your browser and our servers.
• Database connections: Production database connections use SSL/TLS encryption.
• At rest: Data stored with our cloud providers is encrypted at rest using industry-standard AES-256 encryption, as provided by each sub-processor.
• Authentication: Session tokens are stored in HTTP-only cookies and validated on every authenticated request.

Authentication and Access Control

Access to the platform requires email-based authentication with one-time verification codes. Each account is tied to a unique user identity.

• Session tokens expire and can be invalidated on logout or account deletion
• API routes enforce authentication independently — middleware does not protect API endpoints
• Internal background jobs and admin tools use separate secret tokens, not user sessions
• Unauthorized access attempts return generic errors to avoid leaking resource existence

Data Isolation

Customer data is isolated at multiple layers:

• Application layer: Every user-facing API route verifies ownership before returning project, survey, interview, or focus group data.
• Database layer: PostgreSQL row-level security (RLS) policies enforce per-user isolation at the database level, providing defense in depth beyond application checks.
• Account deletion: Deleting your account removes associated projects and research data via cascading deletes.

AI Processing

Research inputs (prompts, topics, uploaded documents) are sent to third-party AI providers only to execute your requested studies — focus groups, surveys, and interviews. We use OpenAI, Anthropic, Google Gemini, and xAI Grok. AI providers process data according to their respective terms and data processing agreements. We do not use your research content to train third-party foundation models.

Sub-processors

We use the following third-party service providers to operate the platform. We may update this list from time to time with reasonable notice to enterprise customers.

Data Location and Transfers

Artificial Populations is operated from Quebec, Canada. Personal information may be stored and processed in Canada, the United States, and other jurisdictions where our sub-processors operate. Where data is transferred outside Quebec or Canada, we implement appropriate contractual, technical, and organizational safeguards as required by applicable law. See our Privacy Policy for details.

Retention and Deletion

We retain data for as long as your account is active and as needed to provide the Services. You may delete individual projects or your entire account at any time. Account deletion removes associated research data from our primary database. Backups may persist for a limited period before being overwritten. See Privacy Policy §7 for full retention details.

Audit Logging

We maintain internal audit logs of sensitive data access — including logins, project views, exports, and deletions. These logs are available for enterprise due diligence upon request and support our security monitoring practices.

Compliance

We process personal information in accordance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and applicable Canadian privacy legislation.

Enterprise customers may request a countersigned Data Processing Agreement (DPA) covering GDPR-aligned processing obligations, sub-processor management, and breach notification.

Security Inquiries

For security questions, vulnerability reports, or enterprise compliance requests, contact us at info@artificialpopulations.com.