Security & privacy
Your study data. Handled responsibly.
Cauliflower combines analysis and collaboration with EU hosting, controlled access and transparent data processing. Here you will find information for your research, IT and procurement teams.
Data hosting & GDPR
Hosted in the EU. Your data in view.
Cauliflower is developed in Hamburg and operated in European data centres. Customer data is processed within the EU and encrypted in transit and at rest. We enter into a data processing agreement for the processing of your data.
All infrastructure runs in EU data centres. Built in Hamburg, hosted in Frankfurt and Dublin.
Data handling and processing designed to meet GDPR requirements end to end.
We sign a data processing agreement with every customer.
EU regions: Frankfurt, Germany (eu-central-1) and Dublin, Ireland (eu-west-1). Customer data is processed in the EU.
Infrastructure & operations
How the platform is operated.
Operations, encryption and delivery in detail – for security reviews and procurement checks.
PostgreSQL 16.x on Amazon RDS, running Multi-AZ. Storage on EBS GP3, encrypted with AWS KMS under a Customer Managed Key – database, snapshots and backups included. Security patches are applied in defined maintenance windows.
The database is reachable only from private subnets, with no public IP addresses and no routing through an internet gateway. Access is granted via security groups rather than CIDR ranges; administrative access runs exclusively through AWS Systems Manager Session Manager.
TLS 1.3 as the default for all external and internal connections, TLS 1.2 as the minimum. Older protocol versions are disabled. Database connections are TLS-encrypted throughout, with certificate validation.
Credentials, API keys and certificates live in AWS Secrets Manager with automated rotation. They are injected at runtime – no secret sits in a repository, a container image or a configuration file.
Deployment and security testing
An automated, Terraform-based CI/CD pipeline. Infrastructure changes happen only as versioned code, with no manual access to production systems. Four checks run inside every deployment; findings of high severity or above fail the build.
Remediation deadlines in production
- Critical24 hours
- High7 days
- Medium30 days
Access & governance
The right access for every team.
Decide who can view, edit and share studies and dashboards. Personal accounts and sharing links support different ways of working together. You can protect sharing links with passwords and expiry dates, and revoke them at any time.
| Admin | Editor seat | Viewer seat | |
|---|---|---|---|
| View dashboards | Allowed | Allowed | Allowed |
| Edit & analyse | Allowed | Allowed | Not permitted |
| Share pages & links | Allowed | Allowed | Not permitted |
| Manage members, roles & seats | Allowed | Not permitted | Not permitted |
Invite the whole team, assign roles and seats for the workspace, and change them at any time.
Enterprise security
Enterprise options for regulated teams.
For teams with strict IT, procurement and compliance requirements – single sign-on, isolated environments and the operational guarantees enterprise buyers expect.
Single sign-on (SSO)
Signing in through your identity provider is supported in principle. We agree the specifics as part of the offer.
Private tenant
A dedicated, isolated environment for your organisation – separate from shared infrastructure.
On-premise
Deploy Cauliflower inside your own infrastructure when data must stay on your systems.
Custom integrations
Connect Cauliflower to your data stack and internal tools via API and custom connectors.
Dedicated TAM + SLA
A named technical account manager and a contractual service-level agreement.
AI & data handling
AI for your analysis. No training on your data.
Cauliflower uses AI to recognise study structures, analyse open responses and provide data-based answers. You can review results, adjust categories and trace original statements. Your customer data is used neither to train our models nor to train the foundation models we use.
Trust slipped 8 points among 18–34 since wave 2 – price perception is the main driver.
Brand Tracker 2026 → Trust by wave chart, filtered to age 18–34.
Answers come from your research model and dashboards – not the open web.
Every answer cites base size, filter and the exact chart it came from.
Findings live in the research model, not a disconnected chat log.
AI runs on OpenAI models via Microsoft Azure in an EU region – processing stays in the EU.
Your research data is not used to train Cauliflower models or the foundation models it runs on.
Where the models run
Inference on external models runs exclusively through Microsoft Azure OpenAI Service in the Sweden Central region, as an EU Data Zone deployment – so processing demonstrably stays inside the EU data zone. Use of your data to train or improve models is contractually excluded. Cauliflower's own models run in the same AWS environment as the platform; data does not leave our own infrastructure there.
Where AI acts
Transparency about what is generated automatically.
Four places in Cauliflower work with AI. Here is which – and what stays in your hands.
Asks respondents targeted follow-up questions while the survey is still open.
Maps open answers to your codebook, detects sentiment and summarises topics. The codebook stays yours.
Drafts a takeaway for a chart. You edit it, keep it or discard it.
Answers from your research model, not the open web. Every answer points back to its source.
Security documents
The documents for your IT and procurement teams.
On request, we provide our data processing agreement, technical and organisational measures, and information about the subprocessors we use. Together, we clarify your requirements for hosting, access and operations. If needed, we sign a non-disclosure agreement before exchanging confidential information.
DPA / AVV
Our standard data processing agreement, ready to sign.
TOMs
Technical and organisational measures protecting your data.
NDA
Mutual non-disclosure agreement before we share sensitive detail.
Security one-pager
A concise summary of our security posture for quick review.
Subprocessors
The current list of subprocessors and what each one handles.
Contact security
Questions from IT, security or procurement? Talk to our team directly.
Let’s clarify your requirements together.
Would you like to review Cauliflower with your IT or procurement team? We discuss your questions about data processing, access and operations and provide the relevant documents. SSO, Private Tenant and On-Premise are available by individual arrangement.
EU-hosted · GDPR-compliant · Answered within 2 business days