PulseSecurity, privacy, and governance at Highlight
How we protect the product feedback, survey responses, and personal data entrusted to us by brands and the Highlighter community.
Report available under NDA
Encryption for all data
Restricted data is off-limits to AI systems
Encrypted and isolated
Data collected by Highlight can include sensitive project details, survey responses, and personally identifiable information. We protect it through a layered security architecture.
Encrypted in transit and at rest
All data is encrypted in transit using transport-layer security (TLS) with industry-best cipher algorithms, and at rest within our cloud datastores (AWS Aurora and S3) using strong ciphers such as AES-256.
Private cloud
Data is stored inside a secure Virtual Private Cloud (VPC) in Amazon Web Services (AWS), with strict ingress rules and layered controls for access, backup, and recovery. Cryptographic keys are held in a Hardware Security Module (HSM) within AWS KMS.
Least privilege, by classification
Access to data follows how sensitive it is and whether the person or system needs it.
Data classification
All data is classified into one of four levels: Restricted, Confidential, Internal Use, or Public. Customer and Highlighter data is typically Confidential, and particularly sensitive fields or records may be Restricted.
Need-to-know access
Access to data classified Internal Use or higher is limited to people and systems with both a legitimate business purpose and adequate training to handle it securely.
SSO and MFA
Where Highlight employees need to review data to deliver our products and services, access is limited to a need-to-know basis and secured by Single Sign On (SSO) and Multi-Factor Authentication (MFA).
Backed up and tested
We plan for recovery, and we test it.
Daily backups
All data stored within Highlight’s VPC is backed up daily, for a Recovery Point Objective (RPO) of no more than 24 hours.
Tested recovery
We regularly test our ability to restore to recent recovery points within a Recovery Time Objective (RTO) of 12 hours.
AI with guardrails
Highlight uses machine learning and AI tools to speed up and improve research, under the same data protection practices as everything else.
How data is used
Highlight’s AI features run on widely used foundation models. Highlight may also aggregate and de-identify data collected through its services and use it for analytics, benchmarking, and data products, as described in our privacy policy and Brand Terms.
Private and access-controlled
AI models run alongside our VPC in AWS Bedrock with restrictive Identity and Access Management (IAM) policies. AI tools are vetted before adoption, and their outputs are subject to human review.
Restricted data is off-limits
No AI systems are approved to access Restricted data. Access to Confidential data is limited to a tightly controlled set of AI applications, held to the same least-privilege principle as approved human operators.
Privacy by design
Highlight complies with the GDPR and UK GDPR. Our privacy practices are set out in our policies, which remain the source of truth.
Controller and processor
Highlight acts as a data controller for personal data collected to operate our platform and community, and as a data processor when processing personal data on behalf of customers for research and analytics.
Retention and deletion
Personal data is scrubbed from active production systems within 30 days of account closure unless the law requires otherwise, and permanently deleted from system backups within 90 days.
International transfers
Personal data transferred outside the EEA or UK is safeguarded by mechanisms such as Standard Contractual Clauses.
Subprocessors
Third-party service providers that process personal data on our behalf must implement appropriate technical and organizational measures. Our current list is published in the privacy policy.
The details, in our own words
How we collect, use, share, and protect personal information, including our subprocessor list.
ReadOpt out of the “sale” of personal information or limit use of sensitive data.
ReadThe cookies and similar technologies we use, and the choices you have.
ReadWhat we collect at the point of collection.
ReadThe master agreement for Highlight customers, including confidentiality obligations.
ReadTerms for members of the Highlighter product testing community.
ReadTrust and security questions
Does Highlight have a SOC 2 report?
Yes. Highlight holds a SOC 2 Type I report. The report and its details are available under NDA.
How do I request the SOC 2 report?
Email support@letshighlight.com and we will share an NDA and route your request.
Is Highlight GDPR compliant?
Yes. Highlight complies with the GDPR and UK GDPR, with Standard Contractual Clauses safeguarding transfers outside the EEA and UK.
How is my data used beyond my own projects?
Highlight may also aggregate and de-identify data collected through its services and use it for analytics, benchmarking, and data products, as described in our privacy policy and Brand Terms. Restricted data is never accessible to AI systems, and Confidential data is limited to approved AI applications.
How do I exercise a privacy right such as access or deletion?
Email privacy@letshighlight.com to submit a data subject request. See the privacy policy and “Your privacy choices” for the rights available in your location.
Who can see my data inside Highlight?
Only people and systems with a legitimate business purpose and appropriate training, on a need-to-know basis, secured by SSO and MFA.