Enterprise security

Customer intelligence, protected at every layer

Your customer feedback carries business-critical context. UserVoice combines independent security testing, encryption and access controls so you can put that intelligence to work with confidence.

Book a demo Request security documentation

Independent assurance

Independently evaluated

SOC 2 Type II

Covering the security, availability and confidentiality of our system, with annual third-party penetration tests and weekly vulnerability scans. Reports available on request.

AES-256

encryption at rest

TLS 1.3

encryption in transit

24/7

monitoring

Access on your terms

Give teams the context. Keep control of access.

Bring customer feedback into your organization without making every piece of it available to everyone.

Connect your identity provider

Use SAML single sign-on for your UserVoice portal, with documented setup for providers including Okta and Microsoft Entra ID.

Explore SAML setup →

Set permissions by responsibility

Control which sections of the Admin Console each internal user can reach, with view-only and view-and-edit permissions. Account settings, permissions and billing are managed separately.

Review admin permissions →

Keep your feedback portal private

Restrict portal access through single sign-on or specified IP ranges. These restrictions apply to the portal; admins still sign in through the admin URL.

See private-site controls →

Protection beyond the login

Safeguards for your data, and the discipline behind them

From the network edge to the release process, security controls shape how UserVoice operates.

Encrypted in transit and at rest

Systems and data use at least AES-256 encryption at rest and TLS 1.3 over HTTPS in transit. Individual personally identifiable information elements are also encrypted within database records.

Layered infrastructure protection

UserVoice primarily runs on Google Cloud Platform. Cloudflare provides CDN, DDoS protection and a web application firewall at the only public entry point. Systems deny access by default.

Independent testing, ongoing review

Annual third-party penetration tests cover the application and internal and external networks. Third-party scans run weekly, with remediation and patching governed by severity-based policies.

Controlled changes and staff access

Every software and configuration change is reviewed and captured in an auditable, reversible trail. Production access is limited by job need, with security training on hire and at least annually.

Read the detailed security overview →

Governed AI access

Your AI assistants. Your UserVoice permissions.

Connect customer intelligence to Claude, ChatGPT and Codex through UserVoice MCP. Each person authorizes with their own UserVoice admin account, and the assistant can only see and change what that account can.

An account owner enables MCP

Account-level control over whether assistants can connect at all.

Each person authorizes through OAuth

Sign-in uses OAuth, so the assistant never sees your UserVoice password.

Existing permissions apply

Read and write access follow the signed-in admin account, restrictions included.

Access can be withdrawn

An owner can disable MCP for the whole account, and anyone can disconnect their own assistant.

SOC 2Type II

UserVoice maintains a SOC 2 Type II certification covering the Security, Availability and Confidentiality of its system, and shares its reports with current and prospective customers on request.

Request the SOC 2 report →Read the MCP authorization guide →

Ready for the unexpected

Resilience you can review, transparency you can see

Your teams depend on customer intelligence. UserVoice supports continuity with round-the-clock monitoring, encrypted backups and a recovery plan that is tested every year.

View service status and incident history →

Monitoring

24/7

Systems are watched around the clock for performance and access anomalies.

Incident response

A formal security incident policy governs response. Uptime and performance incidents are public on our status page, with post-mortems for every significant incident.

Backup and recovery

A near-real-time backup runs in a physically separate data center. Full backups are encrypted nightly and stored with AWS. Disaster recovery and business continuity plans are tested annually.

Auditable internal access

System access is logged centrally and immutably for at least one year, with periodic permission reviews. Production data is never used in development or testing.

Questions from security teams

Can we review UserVoice's SOC 2 report?

Yes. UserVoice maintains a SOC 2 Type II certification covering the Security, Availability and Confidentiality of its system, and shares its reports with current and prospective customers evaluating its security profile. Email compliance@uservoice.com to request a copy.

Can we control who sees customer feedback?

Yes. UserVoice supports admin permissions, SAML single sign-on and private-site settings. Private-site settings apply to the feedback portal; admins can still sign in through the admin URL. Talk to us about the identity, permission and portal setup your organization needs.

Does connecting an AI assistant expand a user's access?

No. UserVoice MCP uses the permissions of the admin account that authorizes the connection, and each person connects individually. An account owner can disable MCP for the whole account. This covers access authorization, not an AI provider's own data retention or model-training policy.

How quickly will we hear about a security incident?

A formal policy governs our response to security incidents. We notify customers within 48 hours of discovering an incident, then coordinate research and communication. Uptime and performance incidents are posted publicly at status.uservoice.com, with post-mortems for significant ones.

Where can we review privacy and data handling?

Start with our privacy policy, security and compliance overview and sub-processor list. For processing terms, data locations or your organization's specific requirements, email compliance@uservoice.com.