What we have, and what we don't yet.

What we have

Data stored and processed in the EU

The database, the application and the background workers run in Railway's EU West region, in the Netherlands. Recordings, uploads and exports sit in a private bucket in Amsterdam and are served only through signed links that expire within an hour.

Encryption in transit and at rest

TLS on every connection. Data at rest is encrypted by our hosting provider, and on top of that we encrypt connection tokens (Figma, GitHub, calendars, Slack), two-step secrets and webhook signing secrets ourselves with AES-256-GCM.

A data processing agreement

A standard Article 28 agreement under UK GDPR and EU GDPR, with the EU Standard Contractual Clauses and the UK Addendum for transfers. It lets an agency name Stroop as a sub-processor to its own clients. Read the DPA.

A public sub-processor list

Every provider that touches customer data, what it does, what data it sees and where it processes it. You get 30 days' notice before we add one. See the list.

AI processing, disclosed and switchable

Summaries, suggested highlights and the analysis assistant use Anthropic's API, which processes in the US or globally. Each workspace has one switch for AI. Off, nothing from that workspace is sent to Anthropic. Studies marked sensitive start with AI off.

No training on your data

We never train AI models on customer data, and that includes everything your participants say, type or record.

Clients kept apart

Every record carries its organisation and workspace, and the API scopes every query by them. Each client workspace keeps its own participants, consent, retention and branding.

Accounts and access

Two-step verification for every member, which an owner can make compulsory. An audit log of sign-ins, permission changes, exports, shares, deletions and AI switches. Stroop staff see your data only through a support access grant you give, and it expires after 7 days.

What we don't have yet

No SOC 2 report

There'll be no badge on this site until an auditor has signed one.

No ISO 27001 certification

We don't hold it, and we don't claim alignment with it either.

No US data region

Everything is stored in the EU. If your data has to stay in the US, we can't host it.

No SAML single sign-on

Members sign in with an email code, a password with two-step verification, Google or Microsoft.

If your procurement needs any of these before you sign, Stroop isn't the right choice yet. We'd rather you read that here than find out after a pilot.

How participants are protected

Consent before capture

Participants agree before any task or recording starts, and the agreement is stored against the exact published version of the form the study used.

A recording indicator that never hides

While anything is being recorded, a “Recording” indicator sits at the top of every page the participant sees. It doesn't pulse and can't be hidden by the study's branding.

Deletion per participant

Find one person by email, phone or pseudonym and delete their recordings, responses, transcripts and diary entries from every study in the workspace. Participants can withdraw from a study at any point, and withdrawal deletes their data.

Retention with a default

Study data is deleted automatically 12 months after the study closes, unless you set another period for the workspace or the study. The owner gets 14 days' notice first.

Sensitive studies

Mark a study sensitive and it adds a special-category consent item, turns AI off, redacts personal details in transcripts and shortens retention to 6 months.

Uploaded code kept away from everything else

Prototype code you upload runs only on withstroop.xyz, a separate domain with no database access, so it can never read Stroop's cookies or act as a signed-in user.