Evaluating security and compliance for AI research platforms

Evaluate AI interview platforms for enterprise and regulated research: data handling, access, GDPR responsibilities, HIPAA requirements, and sharing.

Research teams in enterprise and regulated industries need to know where interview data goes, who can see it, and what the vendor has been independently audited for. This guide covers what Versive provides and what to ask any AI research platform before you run a study.

How Versive protects research data

• SOC 2 Type 2 certified. Request the report from the Versive Trust Center.
• Encrypted in transit and at rest.
• No model training. Versive does not train AI models on your data.
• Access controls. Organization roles, multi-factor authentication, and folder and study permissions control who sees what. Enterprise plans add SSO.
• Revocable sharing. Public links to results and reports can be turned off at any time.

See Organizations & roles and the security section of the pricing page.

What to ask any AI research platform

Whichever platforms you're comparing, your security team will usually want the same things:

It also helps to describe the study up front: who will take part, whether you'll collect voice, video, or screen recordings, and who needs to see the results. For usability studies, use test accounts with sample data so recordings only capture what you need.

GDPR

For research subject to GDPR, your organization typically acts as the controller and the research platform as a processor on your behalf, under a data processing agreement. The European Data Protection Board's guidance explains each side's responsibilities. Read Versive's privacy policy and contact the Versive team for the processing terms your organization needs.

HIPAA and research in healthcare

Versive is not HIPAA compliant, so a study on Versive must not collect protected health information (PHI): anything that identifies a patient together with their health, treatment, or payment details.

Many medical organizations still run research on Versive as long as patient information stays out of it. For example:

• Interviewing clinical or administrative staff about their workflows
• Testing a scheduling or patient-portal interface with fictional data

Ask participants not to discuss individual patients, and use fictional records in any screen-recorded task. A study that needs to collect PHI requires a HIPAA-compliant platform with a business associate agreement. See the HHS guidance on cloud providers.

Share results deliberately

Public links make it easy to share findings with stakeholders who don't have a Versive account. Anyone with the link can open it, so send it only to the people who need it and turn it off when they're done. Treat CSV and PDF exports the same way. See Collaboration.

For a broader comparison of research platforms, see AI-moderated interview platforms compared.