Control withoutceremony

The controls your security and privacy teams ask for, kept out of the way of someone who just needs to send a survey.

Identity and access

Decide who gets in, how they sign in, and what each person can do once they’re there.

SAML single sign-onEnterprise: Connect your identity provider by metadata URL or XML. For your verified domains, passwords are refused and sign-in goes through SSO.
Verified domainsEnterprise: Prove a domain with a DNS TXT record. Each domain belongs to one organization.
Membership on first sign-inEnterprise: People from your domain join with the default role you choose the first time they sign in through SSO.
Owner recoveryEnterprise: Owners keep a password sign-in, so a misconfigured identity provider can’t lock the organization out.
Required two-factorTeam: Every member must set up an authenticator app before they can open the organization.
Allowed email domainsTeam: Invitations and memberships are limited to the email domains you list.
Roles: Owner, admin, editor and viewer, enforced in the database as well as in the interface.

A record of who changed what, ready for your auditors.

Audit log: Membership, security settings, surveys, contacts, exports and deletions are recorded with the person and the time. Filter it by category.
Audit export: Download the log as CSV. The export itself is recorded.
Export records: Every export of survey results is logged with its format and size.

Keep what you need for as long as you need it, and answer people’s requests about their data.

Anonymous surveys: Responses are unlinked from people, times are kept to the day, and no group under five is shown or exported.
Personal data requests: Find everything held about an email address, export it as JSON, or erase it. Requests are audited without storing the address.
Response retentionEnterprise: Delete responses automatically after 90 days to three years. The rule runs every night.
Row-level security: Every table checks which organization a person belongs to before any row is read or written.
Secrets kept out of reach: API keys and invitation tokens are stored only as hashes, and webhook secrets are shown once. Personal survey links are visible to editors only.

Connect wrkflow to your own systems, and put your name on every survey.

REST APITeam: Read surveys and responses and manage contacts with scoped keys that can expire. 600 requests a minute per key.
Signed webhooksTeam: Get new responses and published surveys pushed to your endpoint, signed with HMAC-SHA256, with a delivery log.
Your brand on surveysTeam: Your logo and color on every survey, with text contrast calculated for you.

Tell us what your organization needs: single sign-on, a security review, invoicing or volume pricing. Someone from our team replies by email.

Want to try it first? Create an organization on the Free plan and upgrade later. Nothing you set up is lost.