Security

UserTold.ai protects customer research and provider credentials across storage, processing, and delivery.

Quick Review Checklist

  • Verify saved OpenAI keys (BYOK) are encrypted and scoped per project
  • Confirm data deletion paths for interviews and projects
  • Review tenant isolation and role-based access controls
  • Check webhook signature verification and replay protections

Infrastructure

  • Cloudflare Workers — the platform runs on Cloudflare's edge network with built-in DDoS protection, TLS termination, and global distribution
  • Cloudflare D1 — database storage with encryption at rest
  • Serverless runtime — application requests run in Cloudflare Workers rather than on application servers managed by UserTold

Authentication

  • OAuth sign-in — configured environments can delegate authentication to Google, GitHub, or Linear.
  • Password sign-in — UserTold stores only a unique salted PBKDF2-HMAC-SHA-256 hash for each configured password, never the plaintext password. Password setup and reset links are single-use and time-limited.
  • JWT tokens — signed with ES256 (ECDSA P-256) and validated for the intended audience and issuer
  • HTTP-only cookies — session tokens are stored in HTTP-only, Secure, SameSite=Lax cookies

BYOK Key Custody

Customer-supplied OpenAI keys use envelope encryption. Each Project receives a random 256-bit data-encryption key; provider credentials are encrypted with AES-256-GCM, and the Project key is wrapped separately. Keys remain masked in API responses, stay out of request logs, and can be removed from Project Settings.

A dedicated internal key-broker Worker is the only runtime with access to the versioned keys that wrap Project keys in Cloudflare Secrets Store. Application and processing Workers reach it through a service binding and do not receive that wrapping-key material. Runtime inference reads carry a declared purpose and a D1-verified Interview or processing-job context. Configured BYOK fails closed when custody cannot be verified instead of silently switching to Managed AI. Project-key rotation is explicit; fleet-key rewrap is paged, restartable, idempotent, and reversible while both key versions remain available.

Data Protection

  • TLS everywhere — data in transit is encrypted with TLS
  • Encryption at rest — database and object storage are encrypted
  • Data isolation — project data is isolated by tenant. Cross-project access requires explicit membership.

Private-by-Default Edge Caching

Shared edge caching is opt-in. The default application entrypoint stays uncached, while a dedicated cache-enabled entrypoint accepts only reviewed public reads with explicit methods, paths, representations, and response checks. Private application routes and rejected cache candidates remain on the uncached path and default to private, no-store.

Public widget presentation data varies by Project key rather than being treated as secret customer state. The stable widget loader points to immutable, content-hashed runtime assets in dedicated R2 storage; releases verify their checksums directly against R2 before the application Worker is deployed.

Off-Provider Backups

Daily database snapshots and event-driven copies of new or changed research media are stored in DigitalOcean Spaces, outside the Cloudflare account that runs UserTold. Database snapshots rotate after 90 days. The media copy follows source deletions instead of applying the database snapshot window.

Failed media copies use delayed retries, a dead-letter queue configured for a 14-day buffer, and rate-limited operator alerts. The restore procedure rebuilds derived search indexes and preserves the deletion ledger; after recovery, scheduled cleanup re-applies account erasures made after the restored snapshot.

AI Model Use Policy

  • UserTold does not currently use Customer Data (recordings, transcripts, notes, evidence, or work history) to train internal or third-party AI models. If that changes, we'll update these terms and ask for consent where the law requires it.
  • We do use de-identified aggregate platform telemetry to refine processing algorithms, ranking logic, and prompts.
  • If your organization needs custom terms for AI model training use or other AI-processing terms, contact support@usertold.ai.

Access Control

  • Project-scoped permissions — users can only access projects they are members of
  • Organization-scoped access — organization roles are owner, admin, and member; owners and admins access every project, while members can be limited to selected projects
  • SDK key separation — public keys (ut_pub_...) have limited permissions (intake access, interview creation). They cannot access other projects' data.
  • Rate limiting — abuse-prone endpoints (authentication, uploads, interview creation) are rate-limited

Webhook Security

  • HMAC verification — GitHub, Linear, and Polar webhooks are verified before their payloads are processed
  • Replay protection — Polar and Linear reject stale timestamps; GitHub, Linear, and Polar deliveries are de-duplicated when replay storage is available

Widget Security

  • Shadow DOM isolation — the widget renders inside a Shadow DOM, preventing CSS and JavaScript conflicts with host pages
  • Origin validation — the widget validates allowed origins before loading
  • Interview permissions — the widget always requests microphone access and requests screen sharing when the participant device supports it

Incident Response

If you discover a security vulnerability, report it to support@usertold.ai.

Compliance

  • GDPR — we support data-subject rights including access and erasure; signed-in users can create a portable data export from Settings. Our Data Processing Agreement is incorporated into the Terms of Service; the controller is established in Spain (see the provider notice in the Terms)
  • International transfers — some sub-processors process data outside the EEA, including the US; transfers rely on Standard Contractual Clauses and/or the EU–US Data Privacy Framework. Contact us for residency requirements or a copy of the transfer mechanism.
  • Enterprise data terms — contact us for enterprise terms covering data processing scope, including any ML training exceptions.

Questions

Security questions? Email us at support@usertold.ai.

See also