Securely scheduling for thousands of organizations

Very little by design. Account holders provide a name, email address, and timezone preference. Poll participants provide a name and optionally an email address, and vote as guests without needing accounts. We collect no sensitive personal information, no government identifiers, and no financial account details.

Data is retained while your account is active. You can delete polls and your account at any time. Account deletion starts a 7 day recovery window, after which your data is permanently erased and remaining backup copies expire on our database provider's retention schedule. Inactive polls are automatically scheduled for deletion with a 30 day grace period and advance notice. On request, we delete an organization's data and confirm deletion in writing.

Not currently. Our infrastructure providers are SOC 2 Type 2 and/or ISO 27001 certified, and their attestations are available from each provider. In place of certification we offer what most certified vendors cannot: fully auditable source code, public real-time uptime monitoring, and direct access to the people who build the product.

Yes. Our GDPR Article 28 Data Processing Agreement is published openly and incorporated into our terms of use, so it applies automatically without paperwork. It includes our technical and organizational measures and the full subprocessor list, and we countersign an execution copy on request.

Sign in works with email verification codes, Google, or Microsoft accounts. All inputs are schema-validated, database access goes through a typed ORM with parameterized queries, and dependencies are monitored for vulnerabilities with automated security updates. Every production change goes through version control, code review, automated tests, and staged deployment with instant rollback.

Monitoring and alerting route directly to the engineering team. If a security incident affects your data, we will notify you within 72 hours of becoming aware of it. Rallly has had no data breaches.

Members can sign in with their Google or Microsoft accounts today. Organization-wide SSO enforcement is on our roadmap as part of upcoming organization features.

The production database is backed up continuously with point-in-time recovery, managed by our database provider. The application runs on globally distributed serverless infrastructure and can be redeployed rapidly.

Yes. We complete security and privacy questionnaires for organizational customers, and most answers map directly to the information on this page. Send it to support@rallly.co.