Userflix Trust Center
Actively monitoredUserflix is an AI-moderated customer research platform. Core application and database records are hosted in Germany; platform-user data and study setup and evaluation use EU-configured services. Realtime AI processing for participant interviews follows the selected provider and regional configuration described below.
Documents
Policies and reports. Public documents are available directly; restricted documents are shared on request.
Privacy policy
How we collect, use, and protect personal data.
Customer terms of service
The B2B terms that govern the use of Userflix.
Sub-processor list
All third parties that process customer data on our behalf, incl. transfer safeguards.
Imprint
Legal information about the operator of Userflix.
Data processing agreement (DPA / AVV)
Art. 28 GDPR agreement in German and English, including the applicable subprocessors and transfer safeguards.
Security whitepaper
Architecture, encryption, tenant separation, logging, and incident handling — the questionnaire-ready summary.
Technical and organizational measures (TOMs)
Current technical and organisational measures under Art. 32 GDPR.
Penetration test report
A management summary will be made available after completion of the first external pentest in the recurring programme.
Deletion concept
Retention and deletion approach for active data, provider state, security records, and backups; customer-specific commitments follow the applicable agreement.
Incident & vulnerability management
Incident response roles, handling process, and vulnerability-management approach.
Subprocessors
Providers that may process personal data in connection with Userflix services. The applicable signed DPA and its annex remain authoritative; contractual change notices and objection rights continue to apply.
Hetzner
Hetzner Online GmbH, Gunzenhausen, Germany
Germany (EU/EEA)
Hosting and server infrastructure; storage of text transcripts and application data
Transfer safeguard: No third-country transfer — processing exclusively within the EU/EEA
Google Cloud EMEA Limited, Dublin, Ireland, together with relevant affiliates and infrastructure subprocessors
EU/EEA where configured and supported; selected configurations may process in the United States or globally
AI-assisted realtime participant interviews, including voice dialogue and optional screen-content processing
Transfer safeguard: Google Cloud Data Processing Addendum, EU Standard Contractual Clauses, and applicable adequacy decisions
Microsoft Azure
Microsoft Ireland Operations Limited, Dublin, Ireland
EU/EEA for storage and platform processing; selected realtime configurations may process outside the EU/EEA
Cloud infrastructure, file storage, AI-assisted study setup and evaluation, and selected realtime interview processing
Transfer safeguard: EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses (Microsoft DPA)
PostHog
PostHog, Inc., Delaware, USA (EU Cloud: AWS eu-central-1, Frankfurt)
EU (Frankfurt) — PostHog Cloud EU
Public-website analytics; product and usage analytics where separately enabled
Transfer safeguard: EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses; data hosting under the selected EU Cloud offering is in Frankfurt
Myra Security
Myra Security GmbH, Munich, Germany
Germany (EU/EEA)
EU CAPTCHA used as a risk-based abuse-prevention control for participant access
Transfer safeguard: No third-country transfer is intended for the configured EU CAPTCHA service