How we protect participants

Vizain anonymises data before it enters the system. These are the safeguards that apply to every project. Each project's reports list the ones it used.

• PV-01

  No direct identifiers in research data

  No research table, file, log, analytics event or AI prompt holds a participant's name, title, phone, email, address, ID number, face or kept voice recording.

• PV-02

  Anonymisation gate

  Every answer, upload, transcript, document, photo and imported dataset is scanned and redacted before it is saved. Items that cannot be cleared automatically are held encrypted for at most 24 hours for a researcher to fix or discard.

• PV-03

  De-identified transcripts

  Names in transcripts become role labels such as [community leader]; places finer than the project's granularity are generalised.

• PV-04

  Sampling frames stay on your device

  Beneficiary, member or customer lists used for sampling are processed in the browser. Only pseudonymous IDs and stratification attributes are uploaded; the linking key stays with you.

• PV-05

  Separate encrypted contact vault

  Contact details needed for invitations, operational forms or member polls are held in a separate, field-level encrypted vault with per-organisation keys, never joined to research data, never sent to AI, and deleted automatically after fieldwork closes.

• PV-06

  No names or titles in instruments

  Questionnaires, guides and translations are scanned and cannot be published while they contain participants' names, job titles tied to individuals, phone numbers or emails.

• PV-07

  Coarsened location and safe photos

  Precise GPS is used on the device for verification and stored only as an administrative area or grid cell. Photos showing faces or readable documents are blocked on the device.

• PV-08

  Re-identification protection

  Small cells are suppressed, exports are checked for k-anonymity on quasi-identifiers, and quotes are screened for identifying detail.

• PV-09

  Pseudonymous longitudinal linking

  Baseline–endline and tracker waves are linked with pseudonymous keys, never identifiers.

• PV-10

  Automated PII verification

  An automated PII scanner test suite runs on every data path, and a scheduled job scans stored data and alerts on any detected identifier.

• PV-12

  Audio deleted after transcription; transcripts deleted at close

  Audio is deleted as soon as it is transcribed. Transcripts are deleted when the project is closed; published reports and anonymised quotes remain. Every deletion is logged.

• SC-01

  Encryption in transit and at rest

  TLS 1.2+ in transit; encryption at rest; contact-vault fields encrypted with per-organisation keys; field-app data encrypted on the device.

• SC-03

  Signed, expiring links for files

  All media and documents are served through signed, expiring URLs; there are no public buckets.

• SC-04

  Rate limiting and bot protection

  Public form and survey endpoints are rate limited and protected against bots.

• US-02

  Database-enforced tenant isolation

  Row-level security in the database keeps every organisation's data separate.

• US-04

  Immutable audit log

  Access to data, exports, research-setting changes and report publication are recorded in an append-only audit log.

• PR-01

  Data residency

  Each organisation's data stays in its chosen region.

• LL-06

  No training on customer data

  Customer data is never used to train AI models; zero-retention provider settings are used where available, and the AI gateway refuses any payload that fails the PII scanner.

• ET-04

  AI transparency for participants

  Participant-facing pages state where AI is used, how data is anonymised and how to contact a human.