Security

Every survey response is anchored to the Base blockchain through a verification hash. This creates a tamper-proof record that the response was submitted at a specific time and has not been altered. Verification hashes can be independently validated by anyone using the Base block explorer.

Only verification hashes are stored on-chain — actual response content remains in our secured database to protect respondent privacy.

The Platform uses signed-wallet authentication challenges for payout-sensitive actions. This means that before any funds are released, the requesting wallet must cryptographically prove ownership through a signature challenge. We never store or have access to private keys.

Multiple layers of protection prevent fraudulent survey completion and payout manipulation:

The payout system is designed for reliability and correctness:

• Idempotent payout queue with unique keys prevents duplicate payments
• Automatic retry handling for failed transactions
• Reconciliation jobs continuously cross-check database payout state against on-chain transaction records
• Budget auto-stop prevents surveys from spending beyond their funded amount
• Proof-of-funds verification ensures rewards are backed before respondents participate

The Platform is built on Base, Coinbase's network, which inherits Ethereum's security guarantees while providing sub-cent transaction costs and 2-second block times. Our backend infrastructure targets 99.9% uptime with automated alerting for API error spikes, failed payouts, and low treasury balances.

In the event of a security incident or critical issue, the Platform has multiple safeguards:

• Treasury kill switch — Immediately halts all outgoing payouts
• Emergency pause — Suspends survey submissions and reward distribution
• Audit trail — Full event log on every survey lifecycle action (publish, fund, payout, edit)

Emergency controls are tested in staging environments on a regular basis to ensure they function correctly when needed.

Reporting a Vulnerability

If you discover a security vulnerability, please report it through the contact form on our website. We take all reports seriously and will respond within 48 hours. Please do not publicly disclose vulnerabilities before we have had the opportunity to investigate and address them.