Security & Compliance

AwareCX is designed with security, privacy, and data isolation built directly into the platform architecture. The controls described below ensure that customer data remains protected, access is controlled, and organizations operate within clear security boundaries.

Data Isolation

Every record in AwareCX is scoped to a single organization.

Row Level Security (RLS) policies enforce this isolation at the database level. All database queries automatically filter by organization, ensuring that one tenant cannot read, update, or delete another tenant’s data.

This protection applies even if an application-level bug were to occur.

What this means for you:
You do not need to configure anything manually. Data isolation is enforced automatically by the platform.

Authentication & Session Management

AwareCX uses a secure authentication model designed to protect access while minimizing unnecessary tracking.

Email and Password Sign-Up

Users register with an email address and password. Email verification is required before access to the platform is granted.

No Cookies

AwareCX does not use cookies for sessions or tracking.

Sessions are maintained using secure tokens stored in the browser’s local storage through the authentication client. Because there are no session or tracking cookies, there is no cookie banner.

Protected Routes

Every authenticated page verifies three conditions before loading:

• A valid session token

• A verified email address

• Membership in an organization

If any requirement is missing, the user is redirected to the login page.

Role-Based Access Control (RBAC)

AwareCX uses a simple role model to control permissions across the platform.

Roles

Admin

Admins can:

• Create, edit, and delete surveys and assessments

• Manage contacts and accounts

• Configure platform settings

• Manage team members

• Generate API keys

• Configure alert rules

• Access billing features

Member

Members have read-only access and can:

• View dashboards

• View analytics

• View survey results

• View account details

Role Enforcement

Roles are stored in a dedicated user_roles table separate from user profile data.

Permissions are verified using a server-side has_role() function. Because role verification occurs at the database layer rather than in client-side code, this prevents privilege escalation.

Admin-Only Areas

The following areas are restricted to Admin users:

• Settings → Team

• Settings → API Keys

• Settings → Alerts

• Survey and assessment creation

• Contact and account management

• Sending surveys and assessments

API Key Security

API keys used for the Ingest API follow strict security practices.

Hashed Storage

API keys are hashed using SHA-256 before being written to the database.
The raw key is shown only once at creation and is never stored in plain text.

Prefix Display

Only the first eight characters of a key are visible in the Settings → API Keys list for identification.

Revocation

Admins can revoke a key at any time. Revoked keys are permanently disabled and cannot be reactivated.

Last-Used Tracking

Each key records the last time it was used. This helps administrators identify stale or unused keys.

Admin-Only Management

Only users with the Admin role can create, view, or revoke API keys.

Survey & Assessment Link Security

Each survey or assessment invitation generates a unique token tied to a specific recipient record.

Security safeguards include:

• Tokens are single-use

• Once a response is submitted, the link cannot be reused

• Public response pages validate tokens server-side before rendering the survey form

• Tokens cannot be guessed or enumerated

This prevents unauthorized submissions or manipulation of survey results.

Edge Function Security

Backend edge functions handle sensitive platform operations such as API key generation, administration tasks, and payment processing.

Security controls include:

JWT Validation

The calling user's JWT token is validated and the associated user_id is extracted from its claims.

Server-Side Role Checks

Role checks, such as verifying admin privileges, are performed server-side using the service role client before any data modifications occur.

Public Function Handling

Functions that accept public or anonymous traffic, such as survey submissions or webhook receivers, are configured with:

verify_jwt = false

These functions rely on alternative validation methods such as token validation or API key hashing.

Data Deletion

Administrators can permanently delete the following records.

Individual Responses

Deleting a response removes the response record and all associated follow-up answers.

Entire Surveys

Deleting a survey cascades to remove:

• All recipients

• Survey sends

• Responses

• Follow-up answers

• AI insights

To prevent accidental deletion, administrators must type the survey name to confirm.

All deletions are permanent and irreversible.
AwareCX does not include a recycle bin or soft-delete feature.

Compliance & Privacy

AwareCX publishes several legal and compliance documents that describe how the platform handles data and privacy.

Privacy Policy
Published at /privacy and rendered through a Termly embed for automatic legal updates.

Terms of Service
Published at /terms.

Cookies
AwareCX does not use tracking or session cookies.
A cookie policy explaining this is available at /cookies.

Acceptable Use Policy
Published at /acceptable-use.

Refund Policy
Published at /refunds.

Disclaimer
Published at /disclaimer.

Data Residency

All platform data is stored in the cloud database.
Contact support for details about storage regions.

No Third-Party Tracking

AwareCX does not use:

• Google Analytics

• Facebook Pixel

• Any third-party tracking scripts

Because no data is shared with third parties, Global Privacy Control (GPC) is not implemented.

Security Best Practices for Administrators

Administrators play an important role in maintaining a secure environment. The following practices are recommended.

Rotate API Keys Regularly

Revoke unused keys and generate new ones periodically. Quarterly rotation is a good practice for production integrations.

Limit Admin Seats

Only assign the Admin role to users who need to manage surveys, integrations, or platform settings. Use the Member role for users who only need visibility.

Review the Team List

Periodically review Settings → Team and remove inactive members.

Use Test Emails

Before launching a campaign, use the Send Test Email feature to verify branding and deliverability without exposing real recipient data.

Configure Alert Rules

Enable detractor alerts under Settings → Alerts, so your team receives immediate notification when low scores arrive. This helps your organization respond quickly to potential issues.