Security & Compliance

Data isolation

Every record in AwareCX is scoped to a single organization.

Row Level Security (RLS) policies enforce this isolation at the database level. All database queries automatically filter by organization, ensuring that one tenant cannot read, update, or delete another tenant's data. This protection applies even if an application-level bug were to occur.

Authentication & session management

AwareCX uses a secure authentication model designed to protect access while minimizing unnecessary tracking.

Email and password sign-up

Users register with an email address and password. Email verification is required before access to the platform is granted.

No cookies

AwareCX does not use cookies for sessions or tracking.

Sessions are maintained using secure tokens stored in the browser's local storage through the authentication client. Because there are no session or tracking cookies, there is no cookie banner.

Protected routes

Every authenticated page verifies three conditions before loading:

• A valid session token
• A verified email address
• Membership in an organization

If any requirement is missing, the user is redirected to the login page.

Role-based access control (RBAC)

AwareCX uses a tiered role model to control permissions across the platform.

Admin

Admins can:

• Create, edit, and delete surveys and assessments
• Manage contacts and accounts
• Configure platform settings
• Manage team members
• Generate API keys
• Configure alert rules, webhooks, and field mappings
• Enable and configure the ResolveCX module
• Access billing features

Member

Members have read-only access and can:

• View dashboards
• View analytics
• View survey results
• View account details

Agent

The Agent role is granted alongside ResolveCX. Agents can triage tickets, update status and priority, reassign, and add internal notes, but cannot manage surveys, contacts, or organization settings.

Superadmin (platform staff only)

A protected role reserved for AwareCX platform operators. Superadmins have access to the cross-tenant Platform Admin panel and never see customer data unless explicitly granted. This role is not assignable from within a customer organization.

Role enforcement

Roles are stored in a dedicated user_roles table separate from user profile data. Permissions are verified using a server-side has_role() function. Because role verification occurs at the database layer rather than in client-side code, this prevents privilege escalation.

Admin-only areas

• Settings → Team
• Settings → API Keys
• Settings → Alerts
• Settings → Webhooks
• Settings → Field Mappings
• Settings → Billing
• Settings → ResolveCX (when enabled)
• Survey and assessment creation
• Contact and account management
• Sending surveys and assessments
• Account merge and delete

API key security

API keys used for the Ingest API follow strict security practices.

Hashed storage

API keys are hashed using SHA-256 before being written to the database. The raw key is shown only once at creation and is never stored in plain text.

Prefix display

Only the first eight characters of a key are visible in the Settings → API Keys list for identification.

Revocation

Admins can revoke a key at any time. Revoked keys are permanently disabled and cannot be reactivated.

Last-used tracking

Each key records the last time it was used. This helps administrators identify stale or unused keys.

Admin-only management

Only users with the Admin role can create, view, or revoke API keys.

Survey & assessment link security

Each survey or assessment invitation generates a unique token tied to a specific recipient record. Security safeguards include:

• Tokens are single-use.
• Once a response is submitted, the link cannot be reused.
• Public response pages validate tokens server-side before rendering the survey form.
• Tokens cannot be guessed or enumerated.

This prevents unauthorized submissions or manipulation of survey results.

Edge function security

Backend edge functions handle sensitive platform operations such as API key generation, administration tasks, and payment processing.

Authenticated functions

Most edge functions require a valid session. The calling user is resolved server-side, and role checks (for example admin-only operations) are performed before any data is read or modified.

API-key authenticated functions

The Ingest API uses the Authorization: Bearer YOUR_API_KEY header. Each key is hashed (SHA-256) on storage, validated by hash on every request, and scoped to its issuing organization.

Public functions

Functions that accept anonymous traffic (public survey submission, inbound delivery webhooks, the unsubscribe handler) rely on alternative validation: single-use tokens, HMAC-SHA256 signatures on inbound provider webhooks, or rate limiting. They do not require an authenticated session.

Outbound webhook signing

Outbound webhook deliveries are HMAC-SHA256 signed with a per-endpoint secret. The signature is sent in the X-AwareCX-Signature header so downstream systems can verify authenticity. Endpoints that fail 10 consecutive deliveries are automatically disabled.

Data deletion

Administrators can permanently delete the following records.

Individual responses

Deleting a response removes the response record and all associated follow-up answers.

Entire surveys

Deleting a survey cascades to remove:

• All recipients
• Survey sends
• Responses
• Follow-up answers
• AI insights

To prevent accidental deletion, administrators must type the survey name to confirm.

Accounts and contacts

• Delete account. Removes the account but preserves historical responses for the associated contacts.
• Merge account. Combines two or more accounts. Contacts, responses, recipients, and ResolveCX tickets are moved automatically to the surviving record.
• Delete contact. Removes the contact record but does not remove their historical responses.

Organization deletion

Organization deletion is a Platform Admin action. It permanently removes all surveys, assessments, contacts, accounts, responses, tickets, API keys, webhooks, and membership records for that tenant.

Compliance & privacy

AwareCX publishes several legal and compliance documents that describe how the platform handles data and privacy.

• Privacy Policy. Published at /privacy and rendered through a Termly embed for automatic legal updates.
• Terms of Service. Published at /terms.
• Cookies. AwareCX does not use tracking or session cookies. A cookie policy explaining this is available at /cookies.
• Acceptable Use Policy. Published at /acceptable-use.
• Refund Policy. Published at /refunds.
• Disclaimer. Published at /disclaimer.

Data residency

All platform data is stored in the cloud database. Contact support for details about storage regions.

No third-party tracking

AwareCX does not use:

• Google Analytics
• Facebook Pixel
• Any third-party tracking scripts

Because no data is shared with third parties, Global Privacy Control (GPC) is not implemented.

Security best practices for administrators

Administrators play an important role in maintaining a secure environment. The following practices are recommended.

Rotate API keys regularly

Revoke unused keys and generate new ones periodically. Quarterly rotation is a good practice for production integrations.

Limit admin seats

Only assign the Admin role to users who need to manage surveys, integrations, or platform settings. Use the Member role for users who only need visibility.

Review the team list

Periodically review Settings → Team and remove inactive members.

Use test emails

Before launching a campaign, use the Send Test Email feature to verify branding and deliverability without exposing real recipient data.

Configure alert rules

Enable detractor alerts under Settings → Alerts so your team receives immediate notification when low scores arrive. Immediate alerts are available for detractor, dissatisfied, and difficult triggers; "all responses" alerts are delivered as a digest to protect against email volume spikes.