Data Security | Gleepzy

This statement describes the technical and organisational security measures Gleepzy Research applies to protect personal data and client project data across all systems and operations.

01 Overview 02 Data Classification 03 Infrastructure Security 04 Access Controls 05 Data Handling and Processing 06 Endpoint and Device Security 07 Application Security 08 Vendor and Supply Chain Security 09 Incident Response 10 Personnel Security 11 Physical Security 12 Business Continuity 13 Compliance and Audit 14 Contact

Overview

Gleepzy Research is committed to maintaining the confidentiality, integrity, and availability of all data entrusted to us — whether by research respondents, clients, or supply partners. This Data Security Statement describes the controls we maintain across our infrastructure, operations, and supply chain.

Our security programme is designed to meet the requirements of applicable data protection law including India's Digital Personal Data Protection Act 2023, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). Security controls are reviewed at minimum annually and updated to reflect changes in the threat landscape, regulatory requirements, and operational context.

Data Classification

Gleepzy Research classifies data into four tiers that determine handling, access, and storage requirements:

Tier 1 — Highly Sensitive: Respondent PII (names, email addresses, phone numbers), client proprietary research data, contractual and financial records. Strictest access controls, encrypted at rest and in transit, access logged.
Tier 2 — Confidential: Pseudonymised respondent response data, client project briefs and proposals, internal QC methodology documentation. Role-based access, encrypted in transit.
Tier 3 — Internal: Aggregated anonymous research outputs, internal operational data, system logs. Access restricted to Gleepzy personnel.
Tier 4 — Public: Published website content, ESOMAR 37 disclosures, Privacy Policy, Terms of Service. No access restrictions.

All systems that handle Tier 1 or Tier 2 data are subject to the full set of controls described in this statement.

Infrastructure Security

3.1 Hosting and Cloud Infrastructure

Gleepzy Research uses cloud-based infrastructure for all production systems. Our hosting environments are selected based on security certifications (ISO 27001 or equivalent), data residency capabilities, and uptime guarantees. Infrastructure configuration is maintained under version control and reviewed periodically for security hygiene.

3.2 Encryption

All data in transit is encrypted using TLS 1.2 or higher — this applies to all web-facing services, API endpoints, and inter-system communications
Tier 1 data (respondent PII, client data) is encrypted at rest using AES-256 or equivalent
Encryption keys are managed separately from encrypted data and rotated on a defined schedule
Backups are encrypted using the same standards as primary data stores

3.3 Network Security

Production systems are isolated from development and staging environments
Firewall rules restrict inbound and outbound traffic to defined, necessary ports and IP ranges
VPN access is required for all remote administrative access to production systems
Intrusion detection monitoring is applied to production network traffic
DDoS mitigation is in place for all public-facing web services

Access Controls

4.1 Authentication

All internal systems require strong password authentication with a minimum complexity standard enforced
Multi-factor authentication (MFA) is mandatory for all accounts with access to Tier 1 or Tier 2 data
Administrative access to production systems requires MFA and is restricted to named, authorised individuals
Shared or generic accounts are not permitted for systems handling personal data

4.2 Authorisation and Least Privilege

Access to personal data and client project data is granted on a need-to-know basis only
Role-based access controls are applied across all production systems — each role has only the minimum access required for its function
Access rights are reviewed quarterly and adjusted when personnel change roles or leave the organisation
Departing employees have all system access revoked on their last working day

4.3 Audit Logging

All access to Tier 1 data is logged with timestamp, user identity, action performed, and data accessed
Logs are retained for a minimum of 12 months and are tamper-evident
Anomalous access patterns trigger automated alerts for review by the security lead

Data Handling and Processing

5.1 Pseudonymisation

Respondent personal data is pseudonymised before delivery to clients. Data delivered to clients identifies respondents by a non-reversible study token only — no names, email addresses, phone numbers, or other direct identifiers are included in client deliverables unless the study design explicitly requires it and the respondent has provided informed consent for identification.

5.2 Data Minimisation

Gleepzy Research collects and processes only the personal data necessary for the defined research purpose. Survey instruments are reviewed to ensure no unnecessary PII is collected. Profile data for Spinzel panelists is limited to attributes relevant to study targeting and respondent management.

5.3 Data Segregation

Client project data is logically segregated by client — no client can access another client's project data. Respondent PII is stored separately from research response data and linked only by pseudonymous identifier during active project delivery.

5.4 Secure Deletion

Data is securely deleted at the end of its defined retention period (as specified in our Privacy Policy). Deletion processes render data irrecoverable. Deletion of personal data upon respondent request is completed within 30 days of receipt of a verified deletion request.

Endpoint and Device Security

All devices used by Gleepzy Research personnel to access production systems or handle Tier 1/Tier 2 data must run up-to-date operating systems and security patches
Full-disk encryption is required on all laptops and mobile devices used for work purposes
Anti-malware software is installed and kept current on all endpoints
Screen lock is enforced after a maximum of 5 minutes of inactivity on all devices
Work data may not be stored on personal devices without explicit approval and encryption controls in place
Lost or stolen devices are reported immediately and remote wipe is executed within 4 hours of confirmed loss

Application Security

7.1 Survey and Panel Platform

Survey links use unique, randomised tokens per respondent to prevent unauthorised access or ballot stuffing
Session tokens are invalidated after use and cannot be reused
Survey endpoints are protected against common web application vulnerabilities (XSS, CSRF, SQL injection) through input validation and output encoding
CAPTCHA and bot detection are applied at survey entry points
Rate limiting is applied to all public-facing API endpoints

7.2 Development Practices

Security is considered at design stage for all new features handling personal data
Production data is never used in development or testing environments
Dependencies and libraries are monitored for known vulnerabilities and updated on a defined patch schedule
Code changes to systems handling personal data are peer-reviewed before deployment

Vendor and Supply Chain Security

Gleepzy Research applies security requirements to all third-party vendors and supply partners who access or process personal data on our behalf:

Data Processing Agreements (DPAs) are executed with all third-party data processors before any processing commences
Vendors are assessed at onboarding against a security qualification checklist covering encryption, access controls, incident response, and data protection certifications
Cloud service providers are required to maintain ISO 27001 certification or equivalent
Vendor access to Gleepzy systems is granted on a least-privilege basis and reviewed quarterly
Vendors are contractually required to notify Gleepzy Research of any security incident affecting Gleepzy data within 24 hours of discovery

Supply partners who route respondents through Gleepzy studies are not granted access to client data or respondent PII beyond what is necessary for study routing.

Incident Response

9.1 Detection and Reporting

Gleepzy Research operates an internal incident reporting procedure. All personnel are trained to identify and report suspected security incidents immediately to the designated security lead. Automated monitoring alerts supplement human reporting for system-level anomalies.

9.2 Response Timeline

Detection to escalation: within 4 hours of identification
Initial assessment (scope and severity): within 24 hours
Containment and preliminary remediation: within 48 hours where technically feasible
Regulatory notification (where required): within 72 hours of confirmed breach (GDPR); per prescribed DPDP timeline
Affected individual notification: without undue delay following regulatory notification
Full root cause analysis and corrective action report: within 30 days of incident close

9.3 Post-Incident Review

Every security incident, regardless of severity, is documented in an incident log and reviewed by the security lead. Root cause analysis determines whether process, technical, or training changes are required. The incident log is reviewed quarterly and used to inform ongoing security improvements.

9.4 Reporting a Security Concern

To report a suspected security vulnerability or incident involving Gleepzy Research systems or data:

Email: info@gleepzy.com

Subject line: Security Incident — Gleepzy Research

Response time: Within 24 hours

Personnel Security

Background screening is conducted for all personnel with access to Tier 1 data, in accordance with applicable law
All personnel complete data protection and security awareness training on joining and annually thereafter
Personnel with access to production systems or personal data are required to sign confidentiality agreements
Security responsibilities are defined in job descriptions for all roles with data access
Personnel who violate security policies are subject to disciplinary action up to and including termination

Physical Security

Gleepzy Research operates with a remote-first working model. Where personnel work from office locations:

Access to any office location where Tier 1 data may be accessed is restricted to authorised personnel
Paper documents containing personal data are stored securely and destroyed by cross-cut shredding when no longer needed
Screens displaying personal data are positioned to prevent unauthorised viewing (clean desk and screen policy)
Visitors are not permitted unaccompanied access to areas where personal data may be visible

Business Continuity

Critical systems and data are backed up daily; backups are stored in a separate geographic region from primary data
Backup integrity is tested quarterly through restore verification
Recovery Time Objective (RTO) for critical project management systems: 24 hours
Recovery Point Objective (RPO) for critical project data: 24 hours
Multi-source supply architecture ensures no single supply partner failure can halt active fieldwork
Business continuity plan is reviewed annually and tested through tabletop exercises

Compliance and Audit

Gleepzy Research's security controls are designed to support compliance with:

India Digital Personal Data Protection Act 2023 (DPDP)
EU General Data Protection Regulation (GDPR) — Article 32 technical and organisational measures
California Consumer Privacy Act (CCPA)
ESOMAR international code and research quality standards

Our security posture is reviewed internally at minimum annually. Clients with contractual requirements for security audits or assessments may request a security questionnaire completion or a right-to-audit process under the terms of a Master Service Agreement.

Contact

For questions about Gleepzy Research's data security practices, to request a security questionnaire, or to report a concern:

info@gleepzy.com

Phone

+91-7304313345

Website

www.gleepzy.com

This Data Security Statement is effective as of 16 July 2026 and supersedes all prior versions. It is reviewed and updated at minimum annually.

Data Security Statement

On this page