Security and privacy

Where data lives

Fidiba runs on DigitalOcean in its London region, in the United Kingdom. The application server, the PostgreSQL database and file storage are all there. The database is DigitalOcean's managed PostgreSQL on a private network: it accepts connections only from Fidiba's application server and the few addresses we name for administration, never from the open internet.

Cloudflare runs Fidiba's DNS and sits in front of the app, passing visitors on to the server. The server's firewall lets in web traffic only, and remote administration only from addresses we name. Fidiba's services run in containers as an unprivileged user, on a read-only file system.

Encryption

• In transit. Browsers reach Fidiba over HTTPS. The application server talks to the database over TLS and checks the database's certificate.
• At rest. DigitalOcean encrypts the database and file storage at rest. On top of that, Fidiba seals every file it stores (reports, uploads and exports) with a key of its own, so the storage holds only ciphertext. Files are never linked to directly: every download goes back through Fidiba, which checks who is asking.
• Personal answers. Answers to questions marked personal are encrypted with AES-256-GCM, under a key that belongs to the organisation, before they are stored. Only people allowed to see personal answers see them, and they are never charted or grouped.
• Credentials. Keys Fidiba keeps for an organisation, such as its KoboToolbox or ODK Central connection, are sealed with AES-GCM under a master key kept outside the database, so a copy of the database alone cannot read them.
• Passwords are stored only as bcrypt hashes.

Who can see data

• Organisations are kept apart by the database. PostgreSQL row-level security checks the organisation on every query, and the database accounts Fidiba's application and background jobs use cannot bypass it.
• Roles. An organisation gives each member a role, for the whole organisation or for chosen projects: Owner, Project manager, Project viewer or Dashboard viewer. Dashboard viewers see the figures on dashboards, never individual responses. Only Owners manage people and roles.
• Personal answers have their own permission: Owners and Project managers see them, viewers never do.
• Sharing outside the organisation. Dashboards are the only thing that can leave it, as a public link or by email, and only when its editors allow that.
• Signing in. With a password of at least 12 characters, with a one-time link emailed to them that works once within 15 minutes, with Google or with a passkey. Repeated wrong passwords lock the sign-in. Sessions live on the server, travel in an HTTP-only cookie and end after a period of inactivity.
• Phones collecting offline. Responses waiting to send and downloaded record lists are encrypted on the phone with a key that only the collector's PIN unlocks. A PIN keeps the next person on the phone out; it would not stop someone who copies the phone's storage and tries every PIN. A project manager can unlink a lost phone, and a phone that has not synced for 14 days loses access by itself.
• Audit log. Changes to people, roles and settings, and other important actions, are recorded in an audit log in the same step as the change itself.

Fidiba staff

The staff console opens only after signing in with a passkey. It shows an organisation's plan, members and usage, and whether emails were delivered, never their content. To see an organisation's data, a staff member opens a support view, which:

• needs a written reason and lasts 15 or 30 minutes;
• is read-only: nothing can be changed during it;
• cannot show personal answers, export data or change privacy settings;
• is recorded in Fidiba's internal audit log, with who looked, as whom, when and why.

AI features

Plain-language questions, chart notes and setup help use Anthropic's Claude models. Fidiba sends the question, the names and types of the project's fields, counts, and the common values of fields that hold no personal data. To write an answer, the model reads grouped totals. It never receives individual responses, personal answers or credentials, and an Owner can turn AI features off. There are two exceptions, each off until an Owner turns it on. When reading paper forms, the photo of a filled paper form goes to the model to be read, and Fidiba keeps it encrypted for 30 days, then deletes it. When an Owner lets the AI read the answers of a data source, the written answers to its open questions go to the model to find and code themes (also as new answers arrive, if a member turns that on), sum them up and translate them, never personal answers. Under Anthropic's commercial terms, this data is not used to train its models. Fidiba does not use your data to train AI models either.

Transcribing interview and focus group recordings is also off until an Owner turns it on. The recording then goes to AssemblyAI, or to Sunbird AI for Ugandan languages, to be turned into text, and Fidiba asks AssemblyAI to delete its copy once transcribed. Fidiba keeps the recording while the person who added it checks the transcript, and deletes it once the passages are saved, or after seven days if they never are.

An organisation can also connect its own AI app to Fidiba. That app receives figures and totals, never individual responses, and the organisation can disconnect it at any time.

Backups and recovery

DigitalOcean backs up the database every day and keeps the backups for seven days, so the database can be restored to a point within that week. File storage keeps each file in several copies within the region; files are not backed up separately, because report files expire after a few days and the rest can be rebuilt from the database. The key that unseals stored secrets is kept apart from the database and its backups.

Fidiba's restore procedure is tested automatically on disposable databases: a test backs one up, restores it into a fresh database and checks that each organisation's data and its isolation rules come back intact.

Export and deletion

Export. An Owner can export everything the organisation holds as one ZIP file: every data source as CSV with a description of every column, photos, dashboards as PDF and CSV, saved analyses, codebooks, scheduled reports and the member list. Personal answers are left out. Fidiba builds it in the background, stores it encrypted and emails the Owner a link; downloading needs them signed in, only they can download it, each download is recorded, and the file is deleted after 7 days. Owners and project managers can also export a single project as CSV files.

Deleting an organisation. An Owner deletes the organisation in Settings > Your data by typing its name. Everyone is signed out at once, and its form links, WhatsApp collection and public dashboards stop. A background job then deletes its projects, data sources, submissions, records, dashboards, reports, uploaded files and stored keys, and ends any subscription. This normally takes minutes. Deleted data remains in the database backups until they expire, at most seven days later. An export made before deleting stays downloadable by the Owner who made it until its 7 days end.

Erasing a single submission or record from the app is not offered yet. Removing a member deletes what was private to them, such as their unshared analyses and scheduled emails, and leaves the organisation's data in place.

How long we keep data

• An organisation's data stays until the organisation deletes it.
• Report files can be downloaded for 7 days, then are destroyed.
• An uploaded import file is deleted once Fidiba has read it into the project.
• Exports are deleted after 7 days, even after the organisation is deleted.
• Email content is kept for 30 days, then only the fact that it was delivered.

Subprocessors

Fidiba uses these providers to run the service. Each receives only what its part needs.

Street maps in Fidiba use map images that Fidiba's server fetches from OpenStreetMap. It asks only for map squares, never for names, answers or account details. We update this list before adding a new provider.

Reporting a problem

Report a security concern or a suspected breach to [email protected]. If a breach affects your data, we tell you and your organisation without undue delay. Fidiba is run by Fidiba, LLC, a Delaware limited liability company in the United States. How we handle personal data is set out in our privacy notice.