RESEARCH BUILT ON TRUST
Protecting your data is part of everything we do. Explore how Kernwert GmbH manages information security and privacy across our research software and services.
Explore our documentationOUR COMMITMENT
Clear safeguards. Regular reviews.
Supporting evidence when you need it.
Our research platform, its backups and operational logs are hosted in Germany.
VdS-certified information security management and externally audited GDPR compliance.
Penetration testing at least annually, supported by monthly vulnerability scans.
Optional AI features in accordance with the EU AI Act. Customer data is never used to train or improve AI models.
ASSURANCE & STANDARDS
Our information security management system supports a structured approach to risk, with regular reviews and annual external audits by VdS auditors.
Certificate ISS 21013, valid until 31 August 2027.
Certified scope: Development and provision of software and services as well as consulting and training in the areas of market, UX and opinion research.
Request the certificateOur providers maintain ISO/IEC 27001 certification. These certificates cover the respective providers and their certified services.
Request provider certificatesOur GDPR compliance has been assessed and confirmed through an external audit. Supporting documentation is available on request.
Request audit confirmationWe assess accessibility internally against WCAG 2.1 Level AA. Contact us for information about the assessment and its scope.
SECURITY & PRIVACY
How we safeguard your information,
from access to ongoing operations.
Role-based permissions and least-privilege access restrict who can access information. Access rights are reviewed regularly and security-relevant activity is recorded in audit logs.
Code reviews, automated security checks and dependency checks support our development process. Development, testing and production environments are separated.
We use current TLS protocols to protect data in transit and encryption to protect stored data. Technical and organisational measures govern the secure handling of information.
We process research data on our customers’ instructions under a Data Processing Agreement. Our privacy team supports customers with data protection requests.
Project and participant data are deleted within one month after the relevant contract ends. Backup retention and other records are handled under our documented deletion policy. Deletion confirmation is available on request.
Daily backups and regular recovery tests support continuity. Documented incident response and recovery procedures help us respond to disruptions.
Annual server availability is subject to the agreed service terms, including scheduled maintenance and events outside Kernwert’s control. General enquiries are handled Monday–Friday, 09:00–18:00, Berlin time.
Translation, transcription, analysis and AI assistance are optional. Customers can withdraw their choice to use these features at any time.
Research content may itself contain personal information. Our AI System Cards explain the applicable processing arrangements.
Request AI System CardsSUPPORTING DOCUMENTATION
Explore our documentation below. Please contact us and specify the documents you would like to request.
Our certified information security management system, including its scope and validity.
Request documentInformation security certificates of our infrastructure and service providers.
Request documentConfirmation of GDPR compliance established through an external audit.
Request documentAn overview of how we protect information across our software and services.
Request documentOur agreement for processing personal data on behalf of our customers.
Request documentThe safeguards supporting the confidentiality, integrity and availability of data.
Request documentOur service providers, their processing activities and applicable data protection arrangements.
Request documentInformation about our optional AI capabilities and how they process research data.
Request documentA summary of our security testing and automated security checks. (requires an NDA)
Request documentConfirmation of our professional IT liability insurance coverage.
Request documentOUR SERVICE PROVIDERS
Our research platform is hosted in Germany. Additional services use selected EU processing regions. Provider names are available on request. The overview below shows their company locations and services; company locations are distinct from processing locations.
| Provider | Company location | Service |
|---|---|---|
| Germany | Hosting and operation of high-availability server systems | |
| Germany | Exchange hosting and Microsoft 365 services | |
| Germany | Team communication and project management | |
| Germany | Hosting and operation of web conferencing systems | |
| Ireland | Translation, transcription and text analysis APIs | |
| Ireland | Microsoft 365 services and AI analysis and assistance APIs | |
| France | AI analysis and assistance APIs |
Our additional services use selected EU regions. Exceptional access from outside the EU may occur under the applicable contractual arrangements and transfer safeguards. Details are available in our Data Processing Agreement and subprocessor documentation.
LET’S TALK
Contact our team for supporting documents
or questions about security and privacy.
