Your data, your results and your shoppers, protected.
What we run on, how we handle personal data, the research standard we follow and how we keep every mystery shopper anonymous. The rules on this page are Mysterya's own doctrine, the same rules the platform enforces.
Hosted on SOC 2 and ISO/IEC 27001 certified infrastructure.
Data is hosted in the United States, in AWS us-east-1. The certifications below belong to the providers we run on; Mysterya's own controls sit on top of them.
Who handles your data
Every provider that receives personal data, what it does and where. A new provider is added here before it receives any.
| Provider | What it does | Where | Certified |
|---|---|---|---|
| Vercel | Runs the website and apps, and the AI gateway | United States | SOC 2 Type II, ISO/IEC 27001 |
| Supabase on AWS | Database, sign-in and stored photos | United States (us-east-1) | SOC 2 Type II; AWS: ISO/IEC 27001 |
| Resend | Sends account and notification emails | European Union (Ireland) | SOC 2 Type II |
| Stripe | Card payments for one-off studies | United States | PCI DSS Level 1, SOC 2 |
| Anthropic, Google, OpenAI | AI models, reached only through the gateway; no training on our data | United States | SOC 2 Type II |
Handled in line with the GDPR and the region's data laws.
How Mysterya handles the personal data of clients, their teams and auditors, in line with the GDPR, the UAE's Federal Decree-Law 45 of 2021, Saudi Arabia's PDPL and Egypt's Law 151 of 2020.
- EU General Data Protection Regulation (GDPR)
- UAE Federal Decree-Law No. 45 of 2021 (PDPL)
- Saudi Arabia Personal Data Protection Law (PDPL)
- Egypt Personal Data Protection Law No. 151 of 2020
Send a request and confirm your email. We answer within 14 days, and you can ask for a copy of everything we hold or for all of it to be deleted. Questions first? Write to hello@mysterya.cx.
Make a request- U1Only what the work needs
Mysterya collects the personal data an audit, an account or a payout needs, and nothing for its own sake. Shoppers are never asked to record anything about people beyond what a check requires.
- U2Who is responsible for what
For a programme's results, the client decides what is collected and why, and Mysterya processes it on their behalf. For an auditor's own account, identity and payouts, Mysterya is responsible.
- U3Access by need, enforced in the database
Every table carries row-level security, so a person can only read what their workspace, role and scope allow, whichever screen, export or API asks. Mysterya staff sign in with a second factor.
- U4Encrypted in transit and at rest
All traffic uses TLS. Data and files are encrypted at rest by the hosting providers. API keys are stored only as hashes, and accounting-tool tokens are sealed with AES-GCM before they are saved.
- U5Staff actions are logged
Every action Mysterya staff take on a customer's account is written to an audit log that cannot be edited or deleted from the application.
- U6Where data is hosted, said plainly
Data is hosted in the United States (AWS us-east-1) on infrastructure certified to SOC 2 and ISO/IEC 27001. Every provider that handles personal data is named on the trust page, with what it handles. A new provider is added there before it receives data.
- U7AI never trains on customer data
AI features reach model providers only through the AI gateway, under API terms that exclude training on the data sent. Photos are checked for privacy before any client sees them.
- U8People's rights are answered
Anyone can ask to see, correct, export or delete their personal data, or object to its use, from the form at /privacy/request. The person confirms their email first; the request is then answered within 14 days and tracked in Console › Data requests. Erasure follows one data map of every table that points at a person: the account and what identifies them is deleted, client results stay without a link to them, and records the law makes us keep (invoices, payments) are kept with the reason recorded. Where Mysterya processes the data for a client, the client is told and decides with us.
- U9Kept no longer than needed
Programme data is kept while the client's contract runs and deleted on request when it ends. Website and app analytics are deleted after 13 months.
- U10Incidents are reported
If personal data is exposed, affected clients are told without undue delay and within 72 hours of Mysterya confirming it, with what happened, what was affected and what is being done.
A shopper who is recognised stops being a mystery shopper.
So nobody outside Mysterya learns who made a visit: not the venue, not the client reading the results, and not the AI.
- H1Clients see a code, never a name
Wherever a client reads a visit (Echo, Probe, exports, decks, Ask and the API) the auditor is shown as a code such as A-1234. The only exception is a company's own auditors, whom it already employs.
- H2No contact details cross
Clients never see an auditor's email, phone, address, payout details or identity documents. Every message between a reviewer and an auditor goes through Mysterya.
- H3Photos never give the shopper away
The auditor's name, email, phone, booking or confirmation numbers and loyalty numbers are blurred wherever they appear in a photo, before any client can see it.
- H4Discreet in the field
Auditors never photograph staff or other guests, and checks about people need no photo: the comment is the proof. A check that would make the auditor stand out never requires a photo.
- H5Not the same face too often
One auditor makes at most one visit to a brand in a wave, and a programme can cap how many of its brands one auditor visits in a wave.
- H6Conflicts are declared
Auditors list the brands they work for or are close to. They are never offered, invited to or able to claim a visit to those brands.
- H7Identity documents are locked away
Identity documents sit in private storage that only Mysterya staff can open, through a link that expires after five minutes. They are never shown to a client.
- H8Disputes are about the answer, not the person
A client may dispute an answer and see how it was decided. They may not ask who made the visit, and Mysterya will not tell them.
Aligned with ISO 20252, the standard for market research.
How a Mysterya programme meets the requirements of ISO 20252:2019 for market, opinion and social research: an agreed brief, a controlled instrument, vetted fieldworkers, every visit validated, and results that state their own limits.
Mysterya's method is aligned with ISO 20252:2019. Mysterya is not certified to it, and no page, proposal or report may say it is. Each rule in this chapter names the area of the standard it answers.
A standard is only worth quoting if the claim is exact.
Every programme carries a written brief (what the brand wants to learn and what good looks like), its scenarios, locations and schedule before the first visit is booked. Changes to the brief after launch are recorded with their date.
A questionnaire is a draft until a programme manager publishes it. Every published version is numbered and stamped with the doctrine version it was checked against, and every visit records the version it was answered on.
An auditor applies with an identity document, is 18 or over, and is checked by Mysterya staff before they can be offered a single visit. Applications that fail the check are declined or asked for new documents, never approved by default.
Before a visit the auditor sees the scenario, the timing rules, what evidence is needed, the rules that apply to them, and every question they will answer.
Every submitted visit is checked automatically (timings, location, photos, consistency) and then reviewed by a person before it can count. ISO 20252 asks for at least 10% of fieldwork to be validated; Mysterya validates all of it.
Auditors declare the brands they work for or are close to and are never sent to them. One auditor makes at most one visit to a brand in a wave, so staff do not learn a face.
A field partner works under a written contract with the brand, uses auditors held to the same rules, and every visit it delivers is reviewed by the brand exactly like any other.
A reviewer's adjustment, an upheld dispute or a rescoring keeps the original answer, the person, the reason and the date. Nothing is overwritten silently.
Answers, timings, check-in locations, original photos, reviewer decisions with their reasons, and every staff action are kept for the life of the programme so any result can be traced back to the visits behind it.
Every score shows how many visits are behind it, scores with too little behind them are shown as 'not enough data', and a wave is only final once it is released.
We answer security questionnaires and walk your team through the controls. Doctrine asd-1.8, last updated 25 October 2026.