We don’t publish this page to make grand claims — just to be straightforward about how Feedbackzu is built and hosted today. If you need more detail for a vendor security review, email us at security@feedbackzu.com.
Hosting
Feedbackzu is hosted on Amazon Web Services (AWS). We don’t run our own data centers, and we rely on AWS’s physical and infrastructure security for the underlying hardware and network.
Encryption in transit
All traffic to Feedbackzu — the app, the public portal, the API, and the embeddable widget — is served over HTTPS/TLS. We don’t offer an unencrypted HTTP endpoint for anything that handles customer or feedback data.
Authentication
- Account passwords are hashed with Argon2, a modern, deliberately slow password-hashing algorithm — we never store passwords in plain text or with a fast general-purpose hash.
- Sessions expire and are re-validated on the server; an expired or revoked session is rejected even if a client still holds a stale token.
Application-level protections
- Workspace isolation. Every record in the system — feedback items, boards, roadmap entries, changelog posts — is scoped to a workspace ID and every query enforces that scope, so one workspace’s data is never returned in another workspace’s request.
- Rate limiting. Public endpoints (including the widget’s submit and config endpoints) are rate-limited to reduce abuse and basic denial-of-service attempts.
- CORS. Cross-origin requests to authenticated endpoints are restricted; we don’t leave the API open to arbitrary origins.
- Input validation. Fields that get rendered back into a page — like a workspace’s configured accent color — are validated against a strict allow-list before use, rather than passed through unchecked.
Data handling
See our Privacy Policy for what we collect, why, and how long we keep it. We do not sell your data.
What we don’t claim
We are a small team and do not currently hold formal third-party compliance certifications (e.g. SOC 2, ISO 27001). If that’s a hard requirement for your organization, tell us — it helps us prioritize.
Reporting a security issue
If you believe you’ve found a security vulnerability in Feedbackzu, please email security@feedbackzu.com. We ask that you give us a reasonable window to investigate and fix an issue before any public disclosure.