In BlockSurvey, your account and data are protected with end-to-end encryption, powered by your unique secret key. This means only you can access your data, not even BlockSurvey can decrypt it. But with great privacy comes great responsibility: if the secret key is lost, so is access to your account and all collected responses.
To solve this, we’ve introduced a secure and seamless way to protect your secret key using Hardware Security Module (HSM)-based encryption combined with email authentication. This ensures that only you, authenticated through your email account, can access and decrypt your key.
What Is the Secret Key (Recovery Code)?
When you sign up for BlockSurvey, you are assigned a Secret Key- a 12- or 24-word mnemonic phrase. This key:
Establishes your cryptographic identity
Generates your private and public keys
We also provide a Magic Recovery Code to help you regain access without compromising security.
How it works:
Your Secret Key is split into two parts.
One part is sent to your email.
The other is securely stored with BlockSurvey.
During recovery, both parts are combined (after email verification) to reconstruct your Secret Key.
The Problem Today
Many users:
Forget to save their Secret Key
Store it in unsafe locations
Lose it during device changes
Accidentally delete the recovery email
When the key is lost, so is access to the account and all collected data.
What Is HSM and Why Is It Used for Encryption?
HSM stands for Hardware Security Module, a specialized, tamper-resistant hardware device designed to securely generate, store, and manage cryptographic keys. These keys are not accessible by anyone, and they remain within the hardware itself.
In BlockSurvey, we use HSM to encrypt and decrypt your Secret Key in a highly secure environment. HSM provides military-grade protection. It performs encryption operations inside a sealed hardware unit, making it nearly impossible for anyone, including us, to extract your key.
By using HSM, we ensure:
Your Secret Key is never exposed in memory or logs.
Encryption is handled in a controlled, certified environment.
You get enterprise-grade security without needing to manage keys yourself.
How to secure the secret key
Here are the steps to set it up:
Sign in to your BlockSurvey account.
Go to Profile → My Account → Login and Security section.
Click on the "Secure Secret Key" button.
Can BlockSurvey Access the Secret Key?
No, BlockSurvey cannot access your Secret Key- by design. Even though we store the encrypted version of your key, we do not hold the ability to decrypt it. The decryption can only happen when:
You authenticate via your email
The HSM validates your identity and performs the decryption
This means the key is only usable by you and remains private even to us.
What Happens if the HSM Fails or Is Inaccessible?
BlockSurvey uses cloud-managed HSM services from Google Cloud, which are designed for 99.999% uptime, fault tolerance, and automatic backups.
In the rare case, the HSM becomes temporarily inaccessible:
Your data remains safe and encrypted.
Decryption operations are paused until the HSM becomes available again
In case of complete HSM failure (extremely rare), you can use the recovery code, which is received via email during sign-up. This helps with recovering your account without HSM.
What Happens When You Delete Your Account?
When you delete your BlockSurvey account:
All encrypted keys stored with us are permanently deleted
All surveys, responses, and files are removed
Recovery is impossible - even by BlockSurvey
By using HSM encryption, BlockSurvey ensures your Secret Key is always secure, recoverable, and accessible only to you. This gives you the highest level of privacy while eliminating the risk of losing access to your account and data.