The Security of Online Surveys: How Safe is it to Respond?

By Jim Ivers,
Chief Marketing Officer, Vovici

You may have a real threat to your organization’s data security perimeter you may have never considered, much less taken action to prevent. This threat is not the result of some sinister activity or technical exploit of your network — it comes from your employees performing what would generally be perceived as a benign act.

The use of online survey software to collect feedback from customers is growing consistently as companies search for ways to take the pulse of their customer base. As a result, there is a growing roster of companies that offer survey solutions, ranging from simple survey tools to comprehensive enterprise feedback management solutions that help companies build, manage, and analyze survey activity.

Inviting customers to take a survey and collecting results means customer data is exposed. The vast majority of online surveys use email to send invitations to potential respondents. This requires customer data in the form of mailing lists and other information be loaded onto the servers of the survey solution provider. Responses to the survey are also stored on these same servers and are accumulated over time for analysis. Depending on the nature of the survey, the responses result in detailed profiles that include customer information such as:

• Opinions
• Demographics
• Preferences
• Contact information
• Buying habits

Taking a survey is an act of trust by the respondent, who provides this data trusting that it will be used appropriately and handled securely.

Unfortunately, this may not be a valid assumption. As noted, there are many survey solutions on the market, some of which are very inexpensive. However, choosing a low-cost survey solution could mean that your data — both the customer data from the organization and the data from the responses is stored on an unprotected server. Since many of these tools use the software as a service model, the survey data remains on the survey provider’s servers, raising additional questions of data integrity and protection. Data could be stolen in minutes, or destroyed by a hardware failure.

The problem is further exacerbated by the fact that employees within an organization can engage one of these providers without the knowledge of the IT department and security specialists that are in place to protect data. Experience has shown that unless an organization has a strict policy about surveys, most large to medium size organizations will have disconnected pockets of staff doing surveys — each group may be using a different survey vendor. In such cases, it is not unreasonable to believe the data for any given customer may have been uploaded to multiple servers, some with a potentially questionable security profile.

As the adoption of online feedback has increased, there is a distinct and growing movement by organizations to centralize feedback activity. While security is one reason, control over the process is also important. Branding, elimination of survey fatigue, and the ability to better share the feedback data across the organization are elements of control attained through centralized feedback. Centralizing and standardizing survey management makes it easier to enforce security standards and requirements, making security an important criterion in selecting a survey vendor.

Companies are waking up to the fact that the casual use of low cost survey software is creating a real and potentially widespread security threat. The bottom line is that while collecting customer feedback is a noble goal, organizations should be much more aware of the potential risks associated with low-cost solutions. Enterprises should take steps to identify what survey tools are in use within their organization. Security should move to the front of the list when selecting a survey provider; the money saved by using a low-cost survey provider is not worth the reputational risk and the potential of lost customers.

The value of having an ongoing dialogue with customers is enormous, and online survey software can provide tremendous value in engaging with customers on a consistent basis. What cannot be forgotten in this process is that the data used to distribute a survey and the data collected with the survey is customer data and must be treated with the same level of protection and integrity required in handling any other customer data. CiS

Vovici (News - Alert) is the pioneer in Enterprise Feedback Management, offering products and services that increase customer loyalty, facilitate collaboration and innovation, influence critical business decisions, and provide a voice to online communities. Organizations worldwide, including more than 58 percent of the Fortune 500, rely on Vovici to help them effectively use surveys to identify employee satisfaction, market research, and customer satisfaction; and act on that information to create long-term relationships, increase profitability and facilitate time-critical actions that drive business results.

CIS Magazine Table of Contents