Cophi protects your data with industry-leading standards.
We’re committed to transparency and continuous improvement when it comes to information security.
Your insights are safe with us.
Cophi is designed with data privacy and organisational trust at its core — from encryption to responsible data access.
Fully GDPR Compliant
All data is securely stored and processed within the EEA, with encryption both in transit and at rest.
Access Control & SSO
Enterprise-level access via Single Sign-On and user-level control ensures your teams stay secure.
Ongoing Monitoring
We continuously test, assess, and evolve our platform’s security posture through audits and external penetration testing.
Our Commitment to Data Protection
GDPR Compliance
We comply with the General Data Protection Regulation (GDPR), ensuring transparency, accountability, and control for all users regarding their personal data.
Key aspects of our compliance include:
Lawful Basis for Data Processing: We collect and process personal data only when necessary and under a lawful basis, such as contract fulfillment or user consent.
User Rights: We support data subjects in exercising their rights, including access, rectification, erasure, portability, and objection to data processing.
Data Minimization: We collect only the data necessary for the purposes outlined, avoiding unnecessary or excessive information gathering.
Retention and Deletion Policies: Personal data is retained only as long as necessary, and deletion requests are honored in accordance with GDPR guidelines.
Security Best Practices
We follow a robust set of controls aligned with industry best practices, including:
Data Encryption: We use encryption in transit (TLS) and at rest to protect sensitive data.
Access Control: Role-based access ensures that only authorized personnel can view or manage customer data.
Regular Security Assessments: Our systems undergo routine vulnerability scanning and internal audits.
Secure Development: We integrate secure coding practices throughout our software development lifecycle.
Incident Response Plan: We maintain a clear and tested protocol for identifying, responding to, and notifying customers in the event of a data incident.
Your Data, Your Control
We believe in empowering our customers with visibility and control over their data. You can trust that your information is handled with care and integrity and if you need further information about any of your data or for data access, requests or privacy-related inquiries, please contact our Data Protection Officer (DPO) at info@cophi.io
Our Data Processing Agreement is available at
Values Report
Cophi’s role depends on how you come to take the values survey.
If your organisation or coach invited you. When a business or coach buys the values survey from Cophi and invites you to it, that business or coach is the data controller. Cophi is their data processor: we handle your answers and report only on their instructions, under our Data Processing Agreement with them. Questions about how your data is used should go to them first, though you can always write to us too.
If you signed up yourself. When you sign up for a free values report on cophi.io, no one else is involved, so Cophi (Network Development Lab Ltd) is the data controller. The rest of this section covers that case.
What we collect. Your work email address, company name and job title, your answers to the values survey, and the report we build from them. We also record whether you asked to receive updates from Cophi, and when you confirmed it.
Why we use it. To email you the survey link, let you sign in, build your report and show it to you. The legal basis is your agreement when you sign up (GDPR Article 6(1)(b), providing the service you ask for). We also use your company and job title for marketing, on the basis of our legitimate interest in understanding who our report reaches. We only send you marketing emails if you ask for updates (see below).
Updates from Cophi. We only send you updates if you tick the optional box and then sign in with your email address. That second step confirms the request came from you. The legal basis is your consent (Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link in any update, or by emailing info@cophi.io. Withdrawing does not affect your report.
Who can see your report. Only you and Cophi staff. The free report has no team view, and your answers are not shared with your employer or anyone else. We do not sell your details.
Where it is kept and who helps us. Your details and report are stored on Google Cloud in the EU. We use Auth0 (Okta) to sign you in with a one-time code and Twilio SendGrid to send emails. These providers process data only on our instructions.
How long we keep it. We keep your details and report for as long as you might want to open the report, and for at most 24 months after your last sign-in. You can ask us to delete them sooner by emailing info@cophi.io.
Your rights. You can ask to see, correct, delete or export your data, or object to how we use it, by emailing info@cophi.io. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.