GetWhy A/S

GetWhy is a global provider of consumer research technology, empowering businesses with AI-driven insights to understand their customers at scale. We uphold the highest standards of data privacy and security — integrating robust encryption, access control, and compliance with industry-leading frameworks.

Proud holders of ISO/IEC 27001:2022 certification, we are continuously raising the bar on protecting our customers' data. Because being more human means being more secure.

Be More Human.

Compliance

ISO 27001:2022

SOC 2
GDPR

Resources

Compliance Certifications

ISO/IEC 27001:2022

ISMS

02-ISMS Information Security Management System (ISMS) Policy (EN)

03-ISMS Roles, Responsibilities, and Authorities (EN)

04-ISMS Risk Assessment and Risk Treatment Process (EN)

05-ISMS Procedure for the Control of Documented Information (EN)

Policies

Human Resource Security Policy (EN)

Third-Party Management Policy (EN)

Risk Management Policy (EN)

Asset Management Policy (EN)

Security Testing

ReTest Security - Web pentest (EN)

Controls

Updated 2 minutes ago

Infrastructure security

• Encryption key access restricted
• Access control procedures established
• Production database access restricted

Organizational security

• Employee background checks performed
• Confidentiality Agreement acknowledged by contractors
• Confidentiality Agreement acknowledged by employees

Product security

• Data encryption utilized
• Control self-assessments conducted
• Penetration testing performed

Internal security procedures

• Cybersecurity insurance maintained
• Configuration management system established
• SOC 2 - System Description

Data and privacy

• Data retention procedures established
• Data classification policy established

Data collected

• Customer personally identifiable information
• Employee personally identifiable information
• Credit card information
• Personal health information

Subprocessors

Amazon Web Services
• Cloud provider
410 Terry Avenue North, WA 98109-510, USA
Data storage, backups, CDN, DNS, SSL, domain management, emails

Google LLC
• Audio transcription, natural language processing (English language studies)
1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Microsoft Corporation
• Audio transcription, natural language processing (Non-English language studies)
One Microsoft Way, Redmond, WE 98052-6399, USA

Typeform SL
• Participant qualification
C/Bac de Roda, 163 (Local), 08018, Barcelona, Spain

Vanta connects to a company's core systems to continuously monitor these controls.