Can you advise me how Network Canvas data is stored, and on what server/cloud? Is it solely stored on the project lead’s device or is it stored on a designated server whereby others may potentially have access to the project data collected?
1 Like
Where Network Canvas data is stored is up to the researcher. You have the option of saving data locally on the device you are using (which is part of the workflow typically used by those working in the field without a network connection) and deleting it later after you are able to save it to your secure location of choice (e.g., institutional server). You can also securely transmit your data after each interview directly to Server from the Network Canvas field device so long as they are paired. The Server application of the Network Canvas suite, however, is a desktop app and not a server in the way you may be thinking (this has been a frequent point of confusion for many people!). Using Server poses substantial complexity for many users due to institutional network configurations, so we typically encourage against its use as much of the functionality obtained via Server is available using Interviewer and whatever data storage solution you choose.
TL;DR - The data collected in the field is yours, and is only ever stored on your devices. Who has access to these data depends on who controls the devices used for data collection and who has access to wherever you store your study data files.
Information about the Network Canvas security model can be found here: Overview of Security Model - Network Canvas Documentation
For more information about Server and other data related question, please refer to our documentation site: https://documentation.networkcanvas.com
Dear Network Canvas Support Team
I am reaching out on behalf of our research team regarding the use of the Network Canvas application in an upcoming study. We intend to use only Network Canvas Architect and Interviewer, and not the third application in your suite, Network Canvas Server.
While reviewing the documentation on your website, we noted the following statement:
“Data transmitted between Interviewer and Server are encrypted using a symmetric encryption algorithm called Advanced Encryption Standard (AES) which secures its integrity before transmission. Once the data are encrypted, they are sent securely to Server using Transport Layer Security (TLS).”
Since we will not be using Network Canvas Server, we would like to confirm:
- Is this statement still relevant for our use case involving only Architect and Interviewer?
- When using Architect and Interviewer locally and without the Server component, can you confirm that no data are transmitted outside the local device or to external servers?
- Are there any background processes (e.g., crash reporting, analytics, or software update checks) that could result in data being transmitted outside our institution’s environment, even without Server?
Our institution’s data protection office has also raised questions regarding the potential transmission of personal or pseudonymized data to third countries (e.g., the United States). Their recommendation was:
Before using the application, an offer from the provider should be requested, and a Data Processing Agreement (DPA) should be concluded, since personal or pseudonymized data might be transmitted to another location (e.g., the USA). Please contact the app provider to inquire whether such agreements can be made.
In this context, we would appreciate clarification on the following points:
- Can a Data Processing Agreement (DPA) be concluded with your organization or is it necessary?
- Does the use of Architect and Interviewer alone—without Server fully avoid any data transfer to external parties?
We would greatly appreciate your support in clarifying these aspects to ensure that our data processing setup is fully compliant with institutional and legal requirements.
Best regards
Hi Naomi!
Welcome to the community.
Despite appearances, we don’t actually have a support team. Just me (the lead developer) and a few others who work on the grant 
A clarification from the outset: Server hasn’t been part of Network Canvas for over 2 years at this point. Any references to it in the documentation should be completely ignored. The current de facto way to use the software is to just use Interviewer and Architect as you describe.
The paragraph you quoted describes the security that protects data transmission between Interviewer and Server. It is not relevant to anything outside of that context.
No data is transmitted in the sense that you are asking about. Data of course must be transmitted for interview data to leave the interview device, and for protocols to be saved and installed on devices.
No data is transmitted automatically, and no data is transmitted to us or by us.
No. The software checks for updates, but this does not transmit data - it sends a request to GitHub for the latest version, and compares this locally with the app version. No identifiable data is part of the request.
No. The software is free and open source and is provided as-is. We do not enter into agreements for this reason. You are welcome (and encouraged) to audit the source code to ensure the functionality is compatible with your intended use case.
Asked and answered above.
My general advice is for you to consider using Fresco instead of Interviewer. You can deploy Fresco using internal resources at your institution, making it entirely self-contained. You can use firewall rules and other pre-existing IT processes to ensure that data does not leave your jurisdiction.
If you’d like to talk in more detail about any of this, please feel free to email me at [email protected].
Thanks!