PGP Encryption for File Transfers

PGP (Pretty Good Privacy) is an industry-standard encryption method that protects the contents of a file. A file encrypted with PGP can only be opened with the matching private key, so its contents stay protected wherever the file is stored or sent.

QuestionPro uses PGP to encrypt response data files delivered to SFTP servers and central data warehouses, so sensitive data remains protected from the moment it leaves QuestionPro until your organization opens it.

1. Encrypt: QuestionPro encrypts the data file with your organization's PGP public key before transfer.

2. Transfer: The encrypted file is delivered to your SFTP server over an encrypted SSH connection.

3. Decrypt: Only your organization's private key, which never leaves your environment, can decrypt the file.

QuestionPro protects data with complementary layers of encryption:

• TLS 1.2 or newer: Secures connections between browsers, applications, and the QuestionPro platform. See TLS 1.1 End of Life.
• SFTP: Secures the connection used to deliver files to your server.
• PGP: Secures the file itself, so it stays encrypted at rest on the destination server, not only while it travels.

Even if a delivered file is accessed by an unauthorized party, its contents remain unreadable without your private key.

1. Generate a PGP key pair within your organization, or use an existing one.

2. Share your organization's public key with QuestionPro when setting up the file delivery. Never share the private key.

3. Configure the SFTP destination for the workflow, including the server address and folder.

4. Run a test delivery and confirm that your team can decrypt the file with the private key.

• Store the private key in a secure key vault or hardware security module.
• Limit private key access to the people and systems that must decrypt files.
• Rotate key pairs according to your security policy, and share the new public key before the old one expires.
• Revoke a key pair immediately if you suspect it has been compromised.

Does QuestionPro ever have access to my private key?

No. QuestionPro needs only your public key to encrypt files. Decryption happens within your organization.

What is the difference between TLS and PGP?

TLS protects data while it moves across a network connection. PGP protects the file itself, so it stays encrypted after it arrives.

What happens when I rotate my keys?

Share your new public key with QuestionPro. Files delivered after the update are encrypted with the new key.