Security & Governance

This overview describes the systems Condulo uses to run and deliver its research: the access-controlled environment in which interview data is held, reviewed and delivered, and the participant interview experience it operates. It is a summary for evaluation and vendor-diligence purposes.

Where applicable, binding obligations are set out in the relevant customer agreement, data processing agreement, participant consent terms and privacy notices. The separate Privacy Policy on this site covers the public condulo.com marketing website.

Condulo uses role-based access controls to limit access to research systems and data. Authorization is enforced server-side and is designed to deny access unless the relevant role has been granted permission.

Customer data is scoped by organization at the data-access layer so that authorized users are limited to records associated with their organization.

Interview recordings are not publicly accessible. Media is stored in private storage and playback is provided through authenticated, short-lived access mechanisms. Data is encrypted in transit and recordings are encrypted at rest by the storage provider.

Access to participant recordings and research data is limited to authorized Condulo personnel, service providers acting on Condulo’s behalf and subject to applicable confidentiality and data-protection obligations, and authorized customer users as applicable.

Before an interview begins:

• The participant is shown a versioned consent agreement and must provide the required affirmations before recording begins. Condulo records the version accepted and the time of acceptance.
• Eligibility screening is completed before the interview, including applicable age and jurisdiction requirements.
• Where an interview requires an additional participant affirmation, the interview does not proceed until that affirmation is provided.
• A participant may request withdrawal. Withdrawal requests are recorded and handled in accordance with applicable contractual and legal requirements.
• Recording initiation is gated on recorded participant consent so that the interview process is designed not to begin recording before the required acceptance has been captured.

Condulo seeks to limit the collection and use of personal information to what is reasonably necessary to recruit participants, conduct interviews, perform quality control, create transcripts and produce research.

Condulo does not sell participant personal information.

Video and audio recordings are used to conduct the interview, create a transcript and support interview-quality and attentiveness review. Condulo does not use interview recordings for facial recognition, voice recognition, biometric identification or biometric authentication.

Authorized third-party service providers may process interview audio or video where necessary to provide transcription or related processing services.

For downstream AI-assisted summarization or analysis, Condulo applies data-classification and masking controls intended to remove or mask direct personal identifiers and restricted fields before the relevant text is sent for processing.

Consent events, access decisions and certain security-relevant actions are recorded in audit logs. Certain audit events are hash-chained so that retrospective alteration of prior entries can be detected.

We state the status of our controls plainly so that customers and prospective customers can evaluate the environment accurately.

Operating today

• Role-based access control and customer-data isolation.
• Private media storage with authenticated, short-lived playback access.
• Encryption in transit and encryption of recordings at rest by the storage provider.
• Participant consent and eligibility screening.
• Data-classification and masking controls for downstream AI-assisted processing.
• Audit logging, including hash-chaining for certain security-relevant events.

Documented or manually operated

• Data retention and deletion. Retention requirements are defined by data category, customer agreement and applicable legal requirements. Deletion requests can be processed manually today; automated scheduled deletion is not yet fully enabled.
• SOC 2 readiness. Condulo maintains an internal mapping of relevant controls to the SOC 2 Trust Services Criteria as preparatory work. Condulo has not completed a SOC 2 examination and does not currently have a SOC 2 report.

Not claimed

Condulo has not yet completed a SOC 2 examination and does not currently hold third-party security certifications. Condulo does not claim ISO 27001, HIPAA or other security or data-protection certifications unless expressly stated in writing.

Condulo uses third-party service providers for functions that may include hosting, storage, transcription, AI-assisted processing, email delivery and participant recruitment.

Condulo maintains a sub-processor register identifying relevant providers, the nature of the service and the categories of data involved. The register can be provided to customers and prospective customers under NDA as part of vendor diligence.

Where required by applicable law or contract, Condulo addresses relevant data-processing and international-transfer requirements in its customer agreements or data processing agreements.

Condulo supports customer and prospective-customer security and privacy diligence. Depending on the scope of the review, materials available under NDA may include:

• A data processing agreement, where applicable.
• The current sub-processor register.
• Documentation describing participant consent and the handling of interview audio and video.
• Data retention and deletion procedures.
• The internal SOC 2 control mapping, subject to the limitations described above.
• Responses to customer security, privacy and compliance questionnaires.

Contact compliance@condulo.com to begin a review, or privacy@condulo.com for data-protection questions.

Good-faith security vulnerability reports may be sent to security@condulo.com. Condulo reviews reported vulnerabilities and will investigate and remediate validated issues as appropriate.