Thoughtexchange

Implementing ThoughtExchange involves several key steps to ensure effective engagement and data collection:

• Account Setup: Create an account at my.thoughtexchange.com using your email or through Single Sign-On (SSO) if available

• Define Objectives: Clearly outline the goals of your engagement to guide the creation of your Exchange.

• Create the Exchange:

  • Title and Objective: Provide a concise title and define the objective of the Exchange.

  • Introduction and Question: Craft an introduction and pose the main question to participants.

  • Attachments: Optionally, include relevant documents or media to provide context.

• Add Survey Questions: If needed, incorporate various types of survey questions to gather specific data.

• Schedule Participation: Set the opening and closing dates and times for the Exchange to manage participation.

• Invite Participants: Distribute the Exchange link via email, Slack, Microsoft Teams, or other communication channels.

• Monitor Engagement: During the active period, oversee participation and address any issues that arise.

• Analyze Results: After the Exchange closes, review the collected data to extract insights and inform decision-making.

ThoughtExchange offers a range of customizable features to align with specific business needs:

1. Engagement Methods: The platform provides multiple data collection methods, including Surveys, Exchanges, and Interviews, allowing organizations to choose the most suitable approach for their objectives.

2. Survey Customization: Users can design surveys with various question types such as Likert scales, dropdowns, comment boxes, and satisfaction scores, enabling tailored data collection.

3. Theming and Categorization: The Edit Results feature allows for the creation of up to 20 summary themes and 20 sub-themes within each, facilitating detailed organization of participant thoughts.

4. Advanced Analytics: The platform's AI-powered Advisor provides instant summaries, key themes, and talking points, enhancing the speed and depth of data analysis.

   thoughtexchange.com

5. Multi-Language Support: ThoughtExchange offers instant translation for participants in over 100 languages, ensuring inclusivity in diverse organizational settings.

   thoughtexchange.com

6. Custom Integrations: The platform supports importing participants directly from systems like Student Information Systems (SIS) or Human Resource Information Systems (HRIS), streamlining data management.

   thoughtexchange.com

7. Security and Privacy Settings: Organizations can configure confidentiality and anonymity settings, control participant access, and implement enterprise-grade single sign-on and domain restrictions to meet specific security requirements.

ThoughtExchange provides comprehensive training and support to ensure new users can effectively utilize their platform:

1. Dedicated Customer Success Managers (CSMs): From the outset, each organization is assigned a dedicated CSM who assists with training, planning, and executing engagements. This personalized support ensures that users receive guidance tailored to their specific needs.

2. Resource Library: The platform offers a rich collection of free guides, eBooks, reports, webinars, and toolkits covering various topics to help users maximize their engagement strategies.

3. Security Training: All users undergo training that covers privacy and security, acceptable use, preventing malware, account management, physical security, and data privacy, ensuring a secure and responsible use of the platform.

ThoughtExchange implements set of security measures to protect user data and ensure privacy:

Data Encryption:

1. In Transit: Data transmitted over public networks is encrypted using Transport Layer Security (TLS) 1.2 or higher, safeguarding information during transmission.

2. At Rest: Stored data is encrypted with Advanced Encryption Standard (AES) 256-bit encryption, ensuring data remains secure when not in use.

Access Controls

1. Multi-Factor Authentication (MFA): MFA is employed for administrative access to production systems, third-party SaaS providers, and internal business systems, adding an extra layer of security.

2. Password Management: Employees are encouraged to use approved password managers to create complex, unique passwords for all systems and services.

Network Security:

1. Segregated Environments: Separate network environments are maintained for testing, development, marketing, customer result sites, and corporate networks, isolating sensitive data.

2. Limited Access: Administrative access to production systems is restricted to the development operations team, minimizing potential unauthorized access.

System Monitoring and Logging:

1. Active Monitoring: Servers, workstations, and mobile devices are actively monitored for vulnerabilities and attacks. User activity logs, server logs, and audit logs are maintained for all systems.

2. Alert Management: Alerts are examined and addressed based on priority to ensure timely responses to potential security incidents.

Regular Security Assessments:

1. Penetration Testing: Regular application and infrastructure penetration tests are conducted. The security and development teams review and prioritize any findings, resolving high and medium-priority issues before deployment.

Virus and Malware Protection:

1. File Scanning: Uploaded files are scanned using redundant ClamAV instances. Infected files are quarantined, and exchange leaders are notified to contact support. Virus definitions are updated hourly.

2. Endpoint Security: Workstations run monitoring tools to detect malware and unsafe configurations. They are required to encrypt data, have strong passwords, and lock when idle.

Mobile Device Management:

1. Centralized Management: Mobile devices used within ThoughtExchange are centrally managed and required to enroll in the mobile device management system, ensuring compliance with security policies.

Data Confidentiality and Privacy:

1. Compliance with Regulations: Internal controls are in place to safeguard data in accordance with applicable laws, including GDPR, PIPEDA, FERPA, CIPA, PPRA, and COPPA.

2. Participant Privacy: Participants' input can be made public as part of the process, but their identities (e.g., email addresses, names) are shared only between the customer and ThoughtExchange, maintaining confidentiality.

Certifications and Commitments:

1. ISO/IEC 27001 and 27701: ThoughtExchange has obtained these certifications, demonstrating adherence to international standards for information security and privacy management.

2. SOC 2 (Type II): Compliance with Trust Services Principles is maintained, with reports available upon request.

3. Student Privacy Pledge: The company has signed this pledge, committing to protecting students' sensitive data and upholding high data privacy standards in the education technology space.

ThoughtExchange policies on data ownership and portability are outlined in their Data Processing Addendum (DPA) and Privacy Policy:

Data Ownership

• Customer as Data Controller: In the context of data protection laws, ThoughtExchange identifies the customer (e.g., the organization using the platform) as the Data Controller. This means that the customer determines the purposes and means of processing personal data. ThoughtExchange acts as the Data Processor, handling data on behalf of the customer.

• Participant Data: Participants' input (such as thoughts and ratings) can be made public as part of the engagement process. However, their identities (e.g., email addresses, names) are shared only between the customer and ThoughtExchange. The association of identity to input is kept private by ThoughtExchange, except as required by legal considerations.

Data Portability

• Participant Rights: Participants have the right to request access to their personal data, as well as the correction, amendment, or deletion of such data where it is inaccurate. ThoughtExchange commits to assisting customers in responding to such requests in accordance with data protection laws.

• Data Export: While specific mechanisms for data export are not detailed in the available documents, ThoughtExchange acknowledges the importance of data portability. They state that upon termination of the agreement, they will return, delete, or anonymize the personal data provided by the customer.

ThoughtExchange policies regarding contract renewal and cancellation are outlined in their Subscription Agreement and Terms of Use. Key points include:

Automatic Renewal

• Annual Renewal: Subscriptions are automatically renewed annually on the anniversary date of the initial subscription. Customers are notified of any price increases at least 120 days prior to the renewal date.

Cancellation Policy

• Customer-Initiated Cancellation: Customers may cancel their subscription at any time during the subscription period by providing written notice. No refund is provided for subscription fees already invoiced or paid.

• ThoughtExchange-Initiated Cancellation: ThoughtExchange reserves the right to restrict, suspend, or terminate access to their platform for any reason, including breaches of their Terms of Use or Acceptable Use Policy, at any time and without notice.

ThoughtExchange adheres to several industry-recognized compliance standards to ensure the security and privacy of user data:

1. ISO/IEC 27001: This standard specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). ThoughtExchange's adherence to ISO/IEC 27001 demonstrates its commitment to managing information security in line with international best practices.

2. ISO/IEC 27701: Serving as an extension to ISO/IEC 27001, this standard focuses on privacy information management. Compliance with ISO/IEC 27701 indicates that ThoughtExchange has implemented a comprehensive framework for managing personally identifiable information (PII) in accordance with global privacy requirements.

3. SOC 2 (Type II): This certification pertains to the Trust Services Criteria of security, availability, processing integrity, confidentiality, and privacy. ThoughtExchange's SOC 2 (Type II) compliance signifies that its systems are designed to keep sensitive data secure and are audited over an extended period to ensure consistent adherence.

4. Cloud Security Alliance (CSA) STAR Registry: ThoughtExchange is listed in the CSA STAR Registry, which is a publicly accessible registry that documents the security and privacy controls provided by popular cloud computing offerings. This listing reflects ThoughtExchange's commitment to transparency and adherence to cloud security best practices.