EchoSpan Trust Center
Security, privacy, and compliance information for customers and partners
EchoSpan is committed to maintaining the security, privacy, and reliability of our platform and the data entrusted to us by our customers. This Trust Center provides an overview of our security practices, data protection measures, and operational controls. The materials below are intended to support customer due diligence and provide transparency into how EchoSpan safeguards sensitive information. For additional questions or requests, please contact support@echospan.com.
Legal and Contracts
This document governs the protection and use of confidential information exchanged in connection with our services. It is designed to reflect how EchoSpan delivers and supports its platform and is used consistently across our customer base.
This Data Processing Addendum (DPA) outlines EchoSpan’s obligations and commitments with respect to the processing of personal data on behalf of its customers. It defines the roles and responsibilities of each party and describes the safeguards in place to ensure that personal data is handled securely and in accordance with applicable data protection laws. This DPA forms part of the agreement governing the use of EchoSpan’s services.
This document provides a detailed overview of how EchoSpan handles customer data within the platform, including how data is collected, processed, stored, and protected. It also outlines the controls available to customers to manage data access, limit exposure, configure platform features, and align usage with internal privacy and security requirements. It is incorporated by reference into the DPA.
The standard terms that govern use of the EchoSpan platform.
Security
This document provides an overview of EchoSpan’s security practices, controls, and infrastructure supporting the delivery of its SaaS platform. EchoSpan is committed to protecting the confidentiality, integrity, and availability of customer data through a combination of technical safeguards, operational processes, and secure cloud infrastructure. The controls described herein are designed to align with industry best practices and support customer security and compliance requirements.
EchoSpan conducts periodic third-party penetration testing to evaluate the security of its platform and identify potential vulnerabilities. These assessments are performed by independent security firms and include testing across authentication, authorization, data protection, and application security controls. Identified findings are reviewed and remediated as appropriate.
EchoSpan’s platform is hosted on Microsoft Azure, a cloud infrastructure provider that maintains independent security and compliance certifications, including SOC 2 and ISO 27001. These certifications reflect Azure’s adherence to rigorous standards for security, availability, and confidentiality at the infrastructure level. EchoSpan leverages these controls as part of its overall security architecture.
Note: Microsoft’s SOC 2 report is available through the Microsoft Service Trust Portal and requires registration and login. This is standard for access to Microsoft compliance documentation.
Privacy and Data
EchoSpan is committed to protecting the privacy of individuals whose data is processed through its platform. Our Privacy Policy outlines how we collect, use, disclose, and safeguard personal information in connection with our services. It also describes the rights available to individuals under applicable data protection laws and how those rights may be exercised.
EchoSpan’s statement of compliance with the General Data Protection Regulation (GDPR).
Subprocessors
EchoSpan utilizes a limited number of subprocessors to support the delivery of its services. These providers are engaged for core functions such as cloud infrastructure and AI-powered features. All subprocessors are evaluated for security and privacy practices and are contractually required to protect customer data in a manner consistent with EchoSpan’s Data Processing Addendum. Subprocessors process personal data only as necessary to provide the services and in accordance with EchoSpan’s instructions.
Current subprocessors include:
Microsoft Azure (Cloud Hosting and Database Infrastructure)
Provides secure cloud infrastructure, including application hosting and managed SQL database services.
OpenAI ChatGPT API (Optional AI Processing Services)
Supports AI-powered features within the EchoSpan platform. Data is processed solely to provide requested functionality and is not used to train publicly available models.
Anthropic Claude API (Optional AI Processing Services, Limited Availability)
Supports AI-powered features within the EchoSpan platform. Data is processed solely to provide requested functionality and is not used to train publicly available models.
MailGun (SMTP Services)
Optional feature for sending system email messages, hosted in the EU.
Stripe (Payment Processing Services)
Processes customer payment transactions and related billing information.
Help Scout (Support Ticketing)
Manages support tickets sent through EchoSpan support.
Current subprocessors include:
Microsoft Azure (Cloud Hosting and Database Infrastructure)
Provides secure cloud infrastructure, including application hosting and managed SQL database services.
OpenAI ChatGPT API (Optional AI Processing Services)
Supports AI-powered features within the EchoSpan platform. Data is processed solely to provide requested functionality and is not used to train publicly available models.
Anthropic Claude API (Optional AI Processing Services, Limited Availability)
Supports AI-powered features within the EchoSpan platform. Data is processed solely to provide requested functionality and is not used to train publicly available models.
MailGun (SMTP Services)
Optional feature for sending system email messages, hosted in the EU.
Stripe (Payment Processing Services)
Processes customer payment transactions and related billing information.
Help Scout (Support Ticketing)
Manages support tickets sent through EchoSpan support.
AI Use
AI Use at EchoSpan
EchoSpan uses AI to help people understand and act on feedback: summarizing results, helping Raters write clearer comments, answering questions about project results, and helping administrators use the platform. This section explains which features use AI, what they share, and how we protect your data.
Our principles
- Your data isn't used to train AI models. Our AI providers process data only to deliver the feature being used.
- AI features are optional. Apart from EchoSpan Help, AI features are part of the Insights Toolkit and are turned on by your administrators.
- You choose the provider. Accounts can choose OpenAI or Anthropic's Claude for Insights Toolkit features.
- AI is labeled. Features that share content with AI say so where they're used, and EchoSpan Help identifies itself as an AI assistant.
- People stay in charge. AI output supports human review and judgment. Administrators can review and edit AI-generated report content, and EchoSpan's AI features don't make decisions about individuals.
- Access follows your permissions. AI features only work with data the signed-in user is allowed to see. EchoSpan's servers enforce this, not the AI.
Features that use AI
| Feature | What it does | What it shares with AI | Provider |
|---|---|---|---|
| Generative AI report content | Summarizes written comments and results in feedback reports. | Survey responses (ratings and comments) for the report being created. | Your selected provider |
| Feedback Writing Assistant and AI-Enhanced Comments | Helps Raters write clear, specific and constructive comments. | The comment the Rater is writing and the survey item it relates to. | Your selected provider |
| InsightScout | Answers questions about a project's results. | Results for the project and people the user is allowed to see. | OpenAI |
| AI development suggestions | Suggests reading and resources for development plans. | The development areas in the plan. | Your selected provider |
| Automatic translation | Translates survey content into other languages. | The survey content being translated. | Your selected provider |
| EchoSpan Help | Answers administrators' questions about using EchoSpan. | The administrator's questions, the page they're on and the project's configuration settings. Never participant names, email addresses or responses. | OpenAI; Microsoft Azure (help article search) |
Where data is processed
EchoSpan's platform and database are hosted on Microsoft Azure in the EU (West Europe). AI requests are processed by the providers on our Subprocessors list under the terms of our Data Processing Addendum.
Intended use
EchoSpan’s AI features are designed to support employee development: understanding feedback, writing clearer comments, and planning growth. They are not designed or intended to make, or to materially influence, decisions about hiring, termination, promotion, compensation, discipline, or other terms of employment, and AI-generated output should not be used for those purposes.
EU AI Act
We follow the EU AI Act and keep documentation for each AI feature covering its purpose, the data it uses and its safeguards. Customers can request it from support@echospan.com.
Business Continuity
This document provides an overview of EchoSpan’s Business Continuity and Disaster Recovery (BCP/DR) program, including the processes and controls in place to maintain service availability and protect customer data in the event of a disruption. EchoSpan’s approach is designed to support timely recovery of critical systems while preserving the security and integrity of the platform. The program is reviewed and tested periodically to ensure continued effectiveness.
About Our Security & Compliance Review Process
EchoSpan provides a comprehensive set of security, privacy, and compliance materials designed to support customer due diligence and procurement processes. These resources include our Data Processing Addendum (DPA), security overview, business continuity documentation, subprocessor disclosures, and related materials available through our Trust Center.
Our standard documentation is designed to align with industry best practices and supports the needs of the vast majority of customer deployments.
For standard engagements, EchoSpan utilizes its established documentation and does not typically support extensive customization of legal agreements or completion of large, enterprise-specific security frameworks.
If there are specific requirements or concerns that are critical to your organization, we are happy to review those individually and determine whether they can be addressed within our existing framework.
For larger-scale or enterprise deployments, EchoSpan can support more customized legal, security, and compliance requirements. These engagements are evaluated and scoped based on the nature and scale of the implementation.
For additional information or to discuss specific requirements, please contact support@echospan.com.
Our standard documentation is designed to align with industry best practices and supports the needs of the vast majority of customer deployments.
For standard engagements, EchoSpan utilizes its established documentation and does not typically support extensive customization of legal agreements or completion of large, enterprise-specific security frameworks.
If there are specific requirements or concerns that are critical to your organization, we are happy to review those individually and determine whether they can be addressed within our existing framework.
For larger-scale or enterprise deployments, EchoSpan can support more customized legal, security, and compliance requirements. These engagements are evaluated and scoped based on the nature and scale of the implementation.
For additional information or to discuss specific requirements, please contact support@echospan.com.