Security & Governance

This overview describes the Condulo application — the access-controlled product our customers sign in to, and the participant interview experience it runs. It is a summary for evaluation purposes. The binding descriptions of our processing live in the in-product Privacy Notice and Terms of Service, and in the data processing agreement we enter into with each customer.

The separate Privacy Policy on this site covers only the public condulo.com marketing website.

Role-based access

Every action in the application is checked against a permission matrix that enumerates each role against each resource and action. The matrix is fail-closed: any combination it does not explicitly grant is denied, so an unrecognised role or a newly added resource is refused rather than allowed by default. Permission denials are recorded as security events rather than passing silently, and the full set of combinations is covered by tests.

Isolation between customers

Customer data is scoped at the database layer rather than in application code or the user interface, so a query cannot return another organisation’s records even if a higher layer is wrong. This boundary is covered by integration tests.

Recordings and media

No interview recording is publicly reachable. Storage buckets are private, and playback is served through short-lived signed URLs issued per viewer and scoped to the viewer’s organisation. Data is encrypted in transit, and recordings are encrypted at rest by the storage provider.

Participants are people, not data sources, and the controls reflect that. Before any interview begins:

• The participant is shown a versioned consent agreement and must give four separate affirmations. The exact document presented is rendered deterministically and fingerprinted, so we can show later precisely what an individual agreed to and when.
• Recording start is refused unless a server-committed acceptance already exists for that participant and organisation. The check is an enforced invariant rather than a procedural step: where it fails, nothing is written, so no recording can exist in the system without an acceptance preceding it.
• Eligibility screening runs first, including age and jurisdiction rules, and a screen intended to exclude participants likely to hold material non-public information.
• Where an interview requires a compliance affirmation, the interview cannot advance past it until the participant gives it.
• A participant can withdraw. Withdrawal records a marker that follows the record onward rather than being applied only at the point of request.

Classification

Every field in the data model carries a sensitivity classification and a redaction strategy. Fields that have not been classified default to the most restricted handling rather than the least, and an automated check prevents new unclassified fields from being added.

Data sent to AI providers

Condulo uses third-party AI services for transcription and summarisation. Classified fields are stripped and personal data is masked before prompts leave the platform, and the application refuses to start in a configuration where that protection would be absent.

Audit record

Consent events, access decisions, and reviewer overrides are written to an audit log whose entries are hash-chained, so that removal or alteration of a past entry is detectable. The chain can be verified on demand.

We would rather be useful to your review than impressive in it, so the status of each control is stated plainly. Please read this section as the authoritative one.

Operating today

• Role-based access control and cross-tenant isolation.
• Private media storage with per-viewer signed playback.
• Data classification, PII masking and classified-field stripping before AI processing.
• Hash-chained audit log with on-demand verification.
• Participant consent, eligibility and MNPI screening, and withdrawal recording.

Documented, not yet enforced automatically

• Data retention. Retention periods are defined per data category and per customer. Automated scheduled destruction is not yet enabled; deletion currently happens on request rather than on a schedule. We will tell you this in diligence rather than let you assume otherwise.
• SOC 2. We maintain an internal control mapping against the SOC 2 Trust Services Criteria, with the evidence for each control identified in our codebase. Condulo has not undergone a SOC 2 audit and is not SOC 2 certified. The mapping is preparatory work, not an attestation.

Planned

• Automated erasure of participant data on request. The data model supports it and the deletion path exists, but the automated redaction process is not yet operational.
• Cryptographic erasure of stored media.

Not claimed

Condulo has not been independently audited or penetration tested, and holds no security certifications. We do not claim ISO 27001, HIPAA or “GDPR certified” status, and no such certification exists for us to hold.

Condulo engages third parties to provide hosting, storage, transcription, summarisation, email delivery and participant recruitment. We maintain a sub-processor register recording each one, the data categories it processes, the processing location, and the safeguards that apply.

The register is provided to customers and prospective customers under NDA rather than published, and forms part of the data processing agreement. Request it from compliance@condulo.com.

The following are available to customers and prospective customers under NDA:

• Data processing agreement, including Article 28 terms and sub-processor annex.
• Sub-processor register.
• Data protection impact assessment covering biometric video processing.
• Records of processing activities.
• Data retention and destruction policy.
• SOC 2 control mapping, with the caveats in section 5 above.

We complete customer security questionnaires. Contact compliance@condulo.com to begin a review, or privacy@condulo.com for data protection questions.

Email security@condulo.com. Our responsible disclosure policy sets out scope, what to expect from us, and safe-harbour terms for good-faith research.