Data Handling
What participant data you receive, how Terac protects it, and your responsibilities as a researcher.
When you run a study, you handle data about real people. This page explains what you receive, what you do not, how Terac protects participant data, and the responsibilities that come with collecting it.
What You Receive
When a participant applies and completes your study, you can see the information relevant to your study:
- Their screening responses
- Their task submissions and uploaded files
- Interview recordings and transcripts, where applicable
- Profile attributes relevant to your filters
What You Do Not Receive
Terac is designed so you can study people without holding their raw identity documents.
- You do not receive participants' government ID images. Identity verification is handled by a third-party partner, and Terac does not share ID documents with researchers.
- You do not receive contact details beyond what a participant explicitly provides for your study.
Because identity is verified upstream, you get the assurance of a verified human without taking on the burden and risk of storing sensitive identity documents yourself.
How Terac Protects Data
Terac protects participant and researcher data with:
- Encryption in transit and at rest
- Access controls that limit who can see what
- Regular security audits
- SOC 2 certification
Terac does not sell personal data, and does not use participant data to train third-party AI models. For the complete picture, see the Privacy Policy.
Your Responsibilities
Once participant data reaches your systems, you become responsible for handling it appropriately. The core obligations:
Get informed consent
Obtain consent before collecting data, and make it clear what you collect, how it is used, and how participants can withdraw. Record consent with a timestamp. See Getting consent practices for how to phrase it.
Minimize what you collect
Collect only the data your stated research purpose requires. Less data means less risk for everyone.
Avoid collecting direct identifiers
Do not ask participants for direct personal identifiers (such as full names, home addresses, or contact details) unless it is essential, disclosed, and consented to. Keep participants pseudonymous wherever possible.
Store and share carefully
Apply security proportionate to the sensitivity of your data. Before sharing a dataset publicly (for example, in a repository), strip identifiers and check that no participant can be re-identified.
Regional Rights
Participants may have rights under regional law, including GDPR (EU) and CCPA (California), such as access, correction, deletion, and portability. Your study must remain compatible with those rights. If you are unsure how a requirement applies to your study, contact support.