Question 1

How does Touchstone protect client and participant data?

Accepted Answer

We use a combination of administrative, technical, and physical safeguards to protect all data collected during research. This includes encrypted data storage and transfer, role-based access controls, multi-factor authentication, and continuous monitoring for unauthorized activity. Our processes align with SOC 2 Type II standards and are reviewed regularly through internal and third-party audits.

Question 2

What does SOC 2 Type II certification mean for my research project?

Accepted Answer

SOC 2 Type II certification verifies that Touchstone’s security and confidentiality controls operate effectively over time. An independent CPA firm evaluates our systems, ensuring consistent protection of client data, participant information, and confidential content. This certification demonstrates long-term trustworthiness and strong internal governance.

Question 3

Is Touchstone compliant with GDPR and CCPA?

Accepted Answer

Yes.  All research operations follow the requirements of the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We maintain compliant consent processes, participant rights management, secure data handling, lawful data transfer protocols, and clear privacy documentation for all relevant studies.

Question 4

How is participant privacy protected during research?

Accepted Answer

Participant data is collected with explicit consent and handled according to strict privacy guidelines. We minimize the amount of personal data collected, use secure storage systems, restrict access to authorized team members, and remove identifying information when possible. All participant data is used only for approved research purposes.

Question 5

How do you secure pre-release content or sensitive materials?

Accepted Answer

Our Secure Content Testing (SCT) platform protects confidential content using dynamic user-level watermarking, invisible forensic watermarking, access controls, and secure hosting protocols. SCT supports video, images, prototypes, storyboards, and documents, ensuring your content remains protected before, during, and after testing.

Question 6

Does Touchstone support secure data transfers for international research?

Accepted Answer

Yes. Touchstone participates in the EU–US and Swiss–US Data Privacy Framework programs, which enable lawful and secure transfer of personal data from Europe to the United States. We also support local compliance requirements and work with regional partners who meet international privacy standards.

Question 7

How do you manage youth and family data, including children under 13?

Accepted Answer

For youth and family market research studies, we follow strict COPPA requirements for parental consent, identity verification, and safe data handling. Our Panelpolls community is certified under the kidSAFE+ COPPA Seal Program, which confirms compliance with FTC-approved child privacy standards.

Question 8

How long does Touchstone retain data after a study is completed?

Accepted Answer

Data retention follows a defined schedule based on the study type and client requirements. Processed datasets, recordings, and project files are securely stored and deleted according to retention timelines set in our internal policy or based on your specific contract. We provide secure deletion documentation upon request.

Question 9

Can clients request access or removal of stored data?

Accepted Answer

Yes. Clients may request access, corrections, or secure deletion of data related to their study. Participants may also request access or removal of their personal information under GDPR or CCPA. Touchstone processes all requests through authenticated and documented workflows.

Question 10

What happens if a security incident occurs?

Accepted Answer

In the rare event of a suspected incident, Touchstone follows a formal incident response plan that includes immediate containment, internal investigation, client notification, remediation, and documentation.

Question 11

Do you vet your vendors and technology platforms?

Accepted Answer

Yes. Every external partner or platform used in research undergoes a vendor risk assessment. We review data handling practices, storage locations, privacy policies, security certifications, and compliance standards before approval.

Market Research Data Privacy and Security

Protecting Your Data with Industry-Leading Security Standards

Our Data Privacy and Security Standards

COPPA Certified for Youth and Family Research

SOC 2 Type II Certified

Data Privacy Framework Participation

Security Measures That Protect Every Project

Strict Data Handling and Storage Standards

Secure Content Delivery for Pre-Release Media and Confidential Materials

Entity Clarification

Trusted by Top Global Brands

Why Clients Trust Touchstone Research

Travis Santa