Is my Research Assistant data encrypted?

Updated

Not by default. The Research Assistant stores your projects in your browser without encryption. The code includes an optional encryption feature, but it's turned off, and there's currently no setting in the app to turn it on.

How your data is protected today

  • Your projects stay in your browser on your device. They aren't uploaded to Subthesis.
  • Browsers keep each website's storage separate, so other websites can't read your Subthesis data.
  • Anyone who can use your computer and browser profile could open the Research Assistant and see your projects. Use a device password and your own browser profile.

About the built-in encryption

The optional feature uses your browser's Web Crypto API with AES-256-GCM. When used, it saves its key in the same browser's localStorage. That would help against some kinds of casual inspection, but it wouldn't protect data from someone with full access to the same browser, because the key sits next to the data.

If your data is sensitive

Don't enter identifiable participant data unless your study protocol allows it. Follow your institution's data rules, and store exported backup files somewhere your IRB or data plan approves.

Related questions

Still need help?

Email us