We don't collect any data from participants apart from the IP address in order to locate them.
One this is collected initially, our security team then delete these new IP addresses daily at 1am. So we have the IP information for a maximum of one day.
Our database is encrypted at rest. For data centre security we use the AWS data centre located in northern Virginia, USA. Security in AWS data centers is very high. For more information see: https://aws.amazon.com/compliance/data-center/controls/.
As our IaaS provider, AWS provides high availability between their data centres. We have deployed critical components of our applications across multiple availability zones and we replicate data between zones. We utilize AWS RDS for managing our database which includes replication. Daily snapshot backups are stored in AWS S3 which provides automatic data replication between data centres within a region and are encrypted using AES-256. Backups are held off site within the same region in AWS on independent infrastructure in a physically separate location.
But as I mentioned, we collect no other data from participants and they remain entirely anonymous with no PII. You can of course ask for any data from these participants using the pre and post study questionnaire part of the survey, but we do not capture anything automatically.