Maze pathway visual representing governance controls, risk posture, and assurance pathways.

Trust Center

Last updated: October 31, 2026

Our security and privacy commitments, current assurance status and supporting evidence.

Assurance status

Framework Status
CSA STAR Level 1 Listed on the CSA STAR Registry — Level 1 Self-Assessment, CAIQ v4.1. A Level 1 listing is the provider's own answers. It is not a third-party certification.
HIPAA HIPAA-aligned program. BAA template available.
Security and privacy review Research Organization plans include HECVAT and DPA support, UK and EU review support, and custom data residency
Your data Your data remains yours. De-identified use is limited to Privacy Policy section 8.1

The reviewer summary, including HECVAT 4.1.6 on request with no published score, is the security review page. This page is updated when that changes.

What is published

Our Privacy Policy, Terms of Use, User Agreement, and Cookie Policy are published in full, along with our CSA STAR Level 1 self-assessment on the registry above.

What we share under review

Everything else travels with a customer relationship rather than the website. We share the review package with institutional customers under NDA or through an active procurement review:

  • BAA template
  • HECVAT responses
  • Trust, security, and governance detail
  • Security testing evidence and control posture
  • Penetration testing evidence and remediation detail
  • Data Processing Agreement and international transfer annexes
  • Data subprocessor list
  • Participant sourcing and consent posture
  • Architecture diagrams
  • Security questionnaire responses
  • Disaster recovery and resilience documentation

This is deliberate. These artifacts describe how a specific deployment is controlled, and they are most useful — and safest — when read alongside the scope they apply to.

Method governance safeguards

These hold on every plan (Inquiry Blueprints, Conference Event Pass, Praxis Collaborative, and Research Organization), and we will put them in writing:

  • Your data: Your data remains yours. On non-private Studio plans and projects that are not marked confidential, not covered by a business associate agreement, and not restricted by an order form or data processing agreement, we may use de-identified, aggregated, or obfuscated data to troubleshoot, debug, check quality, review security, and improve the platform. We do not use customer content to train third-party AI models, we do not use business-associate health information or private or confidential project content for that, and we do not try to re-identify the data. See Privacy Policy section 8.1.
  • Visibility rules: Who can see stories versus pattern views, and under what conditions.
  • Minimum-N protections: Strict group aggregation thresholds before segmented views or filters are shown, preventing de-anonymization of contributors.
  • No individual performance discipline: Study data and lived narratives may not be used for punitive employment actions or individual performance evaluation.
  • Publication boundaries: Patterns as actionable visibility into complex landscapes, not definitive individual verdicts.
  • Personal Sensemaking privacy: Individual reflection entries in Journally and Personal Sensemaking are private to the author.
  • Return loop commitments: What was heard, what changed, and what will be revisited shared back with participant communities.

Spryng's AI-assisted features are transcription, translation and redaction of responses, and the optional AI Pattern Synthesis add-on. Each is optional. An account owner can ask us to turn any of them off for their organization by emailing privacy@spryng.io, and we confirm in writing when it is done. Turning off AI redaction does not turn off rule-based redaction.

How to request the review package

Email security@spryng.io with your organisation and the review stage you are in, or start a conversation.

  • Initial triage response: within 2 business days
  • Review package delivery: aligned to procurement stage and a mutual NDA
  • Follow-up clarification: within 3 business days per round

Scope note

Spryng is operated by Spryng.io LLC. Assurance statements on this page describe the Spryng platform. Engagement-specific controls are defined in the applicable agreement.