For ethics boards

What an ethics board or privacy officer needs to know about a study that runs on Sigmer, and sentences a researcher can quote in an application.

Last reviewed on 1 October 2026. A statement labelled Confidential or Sealed applies only at that level. Every other statement applies to every study.

1. First, ask which level the study uses

Every new study starts at Confidential. Sealed is chosen per study, by the researcher. The researcher states the study's level, and the application should too. The security page compares the two.

2. Sentences for an application

Quote the one that matches the study's level, and only that one.

For a Confidential study, which is the defaultConfidential studies

Sigmer keeps who your participants are apart from what they said. Your team sees each only with the role for it, every read is logged, and the data is encrypted at rest under a key your workspace never has to manage.

For a Sealed studySealed studies

Responses are sealed on the participant's device to keys only your team holds. Sigmer cannot open the responses it has stored, and neither can anyone who compels it to hand them over.

For a one-part Sealed study delivered to the team's own S3-compatible storageSealed studies, delivered to your own storage

Participant data never touches Sigmer.

3. What participants are told

A Sealed study's page shows a lock at the top, and opening it tells participants that their answers are sealed on their device before they leave it.
Sealed studies
When a study declares a retention period, its page states it, under the lock at the top.
When a participant agrees, the record keeps a fingerprint of the exact consent text they were shown and which optional agreements they ticked.
A participant who declines the consent form leaves no response behind.

4. Withdrawal, retention and erasure

Withdrawing a person can mean two things, and the researcher chooses: stop, which ends their participation and deletes their answers where the study promised deletion on withdrawal, or forget, which deletes everything.
A researcher can erase one response, one person across every study in the workspace, or a whole study. Erasing a study destroys its key.
A study can declare how long responses are kept. Each response is stamped with its destruction date when it arrives, and a nightly sweep erases what has passed it, files included. A participant still taking part keeps their schedule until it ends.
Erasure acts on the live database. A copy of the database taken before an erasure keeps what it held until that copy expires.
In an anonymous study, the research team may have no way to tell which answers are yours.

A way for a participant to withdraw from inside the study. They contact the research team, who withdraw them.

5. Access and oversight

Access is by role. A person reads a project's responses only with analyst access or above on it, or as an owner or admin of its workspace, and a reviewer can read and comment on a project without access to its responses.
Every read of a study's stored responses by a person or an API key is recorded in the workspace's audit log, with counts and never content.
The audit log is hash-chained: each entry carries the hash of the one before it, so an edited or deleted entry breaks the chain. Workspace owners and admins can run the check, and keep the newest hash outside Sigmer to compare against later.
An operator of Sigmer with access to its database and its key service can open a Confidential study's responses. What stands against that is who holds that access, not cryptography: a read through Sigmer's own software is recorded in the workspace's audit log, but one made directly in the database would not appear there.
Confidential studies

6. Where data is held

Each workspace keeps its data in one region, chosen when the workspace is created: the United States or Canada. A workspace stays in the region it is made in.
In a workspace kept in the United States, stored responses and the servers that process them are in the United States.
In a workspace kept in Canada, its projects, studies, team, responses, files, panels, schedules, audit log and logs, and the key that encrypts its Confidential studies, are stored and processed in Google Cloud's Montreal region.
Wherever a workspace is kept, researchers' accounts and sign-in, the list of which workspaces each person belongs to, kept as identifiers, and each researcher's encrypted key for Sealed studies are held in the United States, and Sigmer's email to researchers is sent from there.
Google, and Amazon for participants' email, are United States companies, so keeping a workspace in Canada decides where its data is stored, not which country's courts can ask for it. For that, choose the Sealed level.
This holds when a Sealed study in one part delivers from the participant's browser straight to an Amazon S3 bucket, or other S3-compatible storage, that you hold.
Sealed studies, delivered to your own storage

7. Limits

A Sealed study that runs in several parts and decides the next part from an answer sends that declared answer to Sigmer outside the seal, where Sigmer can read it.
Sealed studies

Electronic signatures and a validation package for 21 CFR Part 11. Sigmer is not for regulated clinical trials. A business associate agreement under HIPAA. Whether your study needs one is for your institution to decide.

The full list of what Sigmer does not offer yet is on the security page.

8. Documents for an application

A pack of documents for ethics applications is being prepared and is not published yet. Until it is, write to hello@sigmer.io, and say which protection level the study uses.