Security and privacy
Participants trust you
with their everyday life.
Zolensa is built so that agencies can meet their duties under the GDPR, the UK GDPR, India’s DPDP Act and the ESOMAR code: clear consent, minimal data, strict access, and deletion when the project ends.
Consent first
Participants read and sign the consent form in their own language before any task. Each signature is stored with the exact version they read, the time and the ticked boxes.
Strict access
Two-factor sign-in for owners and platform staff. Roles limit who sees what; clients see participants by code only and cannot export.
Data minimised
Photos lose their location data. Participants are shown by code. Contact details are visible only to the team that runs the study.
Encrypted in transit
Every page, upload and download uses HTTPS. Provider keys and two-factor secrets are encrypted in our database.
Private file storage
Recordings sit in private storage and play through links that expire after a few hours. Downloads expire after seven days.
Audit trail
Sign-ins, invitations, exports, downloads, consent and deletions are written to an audit log.
Where data is kept
Zolensa runs on DigitalOcean. Today the application, its database and uploaded files are hosted in DigitalOcean’s data centre in Bengaluru, India. Agencies outside India transfer data to us under the EU Standard Contractual Clauses and the UK addendum, which are part of our Data Processing Agreement. Hosting in the European Union and the United States is planned; agencies can tell us their preferred region at sign-up.
Who is responsible for what
The agency running a study is the controller of its participants’ data: it decides what to ask, whom to invite and how long to keep the answers. Astrizon Technology Solutions, which makes Zolensa, is the agency’s processor and acts only on its instructions. The full terms are in the Data Processing Agreement; the providers we use are listed on the Subprocessors page.
Retention and deletion
Each study has a retention period set by the agency. Participants can stop at any time and ask for deletion from the app. Agencies can delete participants and studies, and when an agency leaves, its whole workspace, including files, is deleted.
Protection against fake sign-ups
Every trial request is checked before a workspace is created: robot traps, throwaway email addresses, anonymous networks and the country of the connection. A person on our team approves each new trial.
Report a problem
If you think you have found a security issue, write to support@astrizon.com. Please do not test against real participants’ data.