Security
How Sonda protects your research data, interview transcripts, and stakeholder insights.
Architecture overview
Sonda runs on modern, auditable cloud infrastructure. The application layer (Vercel) handles the designer console and interviewee screens. The interview engine (Fly.io) processes real-time conversation state. The database (Neon PostgreSQL) stores all persistent data. These components communicate over encrypted channels with mutual authentication.
Data encryption
In transit
All connections use TLS 1.2+ (HTTPS). This includes designer console sessions, interviewee interview links, API calls between services, and database connections. No data is transmitted in plaintext.
At rest
Database storage is encrypted at rest via Neon's infrastructure (AES-256). Uploaded files (stimuli, audio) are stored in Cloudflare R2 with server-side encryption. Signed URLs expire after 1 hour.
Authentication & access control
- Designer accounts: Email and password authentication via Better Auth. Passwords are hashed with bcrypt. Magic-link login available.
- Invite-gated signup: New accounts require an invite code — no open registration.
- Interviewees: Access via single-use magic links. No account creation required. Links expire on the schedule set by the designer.
- Role-based access: Four roles (Owner, Designer, Reviewer, Viewer) with a capability matrix governing access to projects, reports, billing, and team management.
- Session tokens: HTTP-only, secure cookies. Automatic expiry.
AI & data processing
- Anthropic (Claude): Interview facilitation, guide generation, and synthesis. Anthropic does not train on API inputs. Data is processed and discarded per Anthropic's API privacy policy.
- OpenAI (Whisper): Audio transcription only. Used when designers upload interview recordings. OpenAI does not train on API inputs.
- ElevenLabs: Text-to-speech for AI interviewer voice. Receives interviewer text only (not interviewee data). Does not train on API inputs.
- Prompt isolation: All LLM calls use system prompts with injection-defense boundaries. Transcript content is treated as data, never as instructions.
Data isolation
Each organization's data is logically isolated at the database level. All queries are scoped by organization ID, enforced at the API layer via capability checks. Cross-organization data access is architecturally impossible through normal API paths.
Evidence integrity
Sonda's synthesis engine validates every claim against the transcript before surfacing it. An automated evidence checker verifies that every quoted passage exists verbatim in the cited transcript segment. Claims that fail validation are stripped, not displayed. This ensures synthesis reports contain zero unsupported claims.
Consent & interviewee rights
- Explicit consent is required before the first interview question — enforced in code, not just UI.
- Interviewees can end the interview at any time.
- Designers control all data. Projects (including all interviews, transcripts, and synthesis) can be deleted from the dashboard.
- No data is shared with third parties beyond the infrastructure providers listed above.
Operational security
- Secrets management: All API keys and credentials stored as environment variables. Never committed to source code.
- Rate limiting: Login attempts, email sending, and API endpoints are rate-limited to prevent abuse.
- Cost circuit breakers: Per-organization and global daily spend caps on AI API usage prevent runaway costs.
- Audit logging: Significant actions (membership changes, role assignments, data deletion) are recorded in an audit log accessible to org owners.
- Error monitoring: Sentry integration for error tracking (when configured). No PII in error reports.
Infrastructure providers
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Application hosting | US (auto-edge) |
| Fly.io | Interview engine | US East (iad) |
| Neon | PostgreSQL database | US East |
| Cloudflare R2 | File storage (stimuli, audio) | Auto (nearest) |
| Anthropic | AI interview + synthesis | US |
| OpenAI | Audio transcription | US |
| ElevenLabs | Voice synthesis | US/EU |
| Resend | Transactional email | US |
Compliance
Sonda is designed with GDPR principles in mind: data minimization, purpose limitation, and data subject rights. We are working toward formal SOC 2 Type II certification. If you have specific compliance requirements, please contact us.
Responsible disclosure
If you discover a security vulnerability, please report it to hello@myaugmenta.com. We will acknowledge receipt within 48 hours and work with you to understand and remediate the issue.
Questions?
For security-related inquiries, contact hello@myaugmenta.com. For general questions, reach us at hello@myaugmenta.com.