Tickbox helps people answer security questionnaires, so we hold ourselves to the same standard. Here is how we protect your data. For anything not covered here, email hello@usetickbox.com.
Hosting and infrastructure
Tickbox runs entirely on Cloudflare's platform (serverless compute, database, storage, and vector search). We do not run our own servers, which removes a large class of patching and configuration risk. Cloudflare maintains SOC 2 and ISO 27001 certified infrastructure.
Your data is isolated to your account
Every questionnaire, policy, and saved answer is tagged to your account, and all queries are scoped to your account. Your uploads and answers are never pooled with, or visible to, other customers.
Encryption
All traffic to and from Tickbox is encrypted in transit with TLS. Data at rest is stored on Cloudflare's encrypted storage.
Authentication
Passwords are never stored in plain text; they are salted and hashed. Sign-in uses a random session token held in a secure, HTTP-only cookie that scripts in your browser cannot read. You can change your password or delete your account at any time from Settings.
How we use AI
Drafting is done by Anthropic's Claude via its API. The content we send is not used to train Anthropic's models. Every answer is a draft for you to review and approve. Tickbox never sends anything on your behalf. See How we use AI for detail.
Data retention and deletion
We keep your content while your account is active. Deleting your account permanently removes your questionnaires, answers, saved library, and uploaded policies, including the search vectors built from your policies, and cancels any subscription. You can also remove individual questionnaires and policies at any time.
Payments
Card payments are handled entirely by Stripe. Tickbox never sees or stores your card number.
No tracking
We use only strictly necessary sign-in cookies and no advertising or analytics trackers. See our Cookie Policy.
Reporting a vulnerability
Found a security issue? Please tell us. See our Responsible Disclosure policy.
Your part
Security is shared. Use a strong, unique password, keep your account credentials private, and only upload content you are entitled to process.
Answer your questionnaire in minutes
Drop it in and Tickbox drafts every answer for you to review. Your first few are free.
Try it free