Timescale PostgreSQL Survey

On Thursday I got informed by the Head of Marketing from Timescale, that my personal data has been leaked.

Emails

First One By Timescale

Hi there,

As you know, we recently published our 2024 State of Postgres Survey. We inadvertently published your email address (connected to your survey responses) in the raw data, which was meant to be anonymized. I am sincerely sorry for this mistake.

This survey was wholly conducted with third-party survey tools by our Marketing team, and was not related in any way to our Cloud Services or system security. When we became aware of this situation, we removed the raw survey data in minutes from our website. We have also contacted our survey partners and asked that they delete or recall any raw data they may have previously shared.

We understand the importance of keeping your data secure and take this responsibility very seriously. We are reviewing our internal processes to prevent a human error like this from happening again.

If you have any questions or would like to discuss this further, please don’t hesitate to contact me at this email address. Thank you for your understanding.

Head of Marketing

Name Removed

Timescale, Inc.

My Answer

Hi there,

Your email makes me believe that you have breached the trust of my anonymous 2024 State of Postgres Survey responses, and shared with the public my confidential responses alongside my name and personal information (email address) in a way that may have made clear what my responses were. I did not expect this to happen, and did not want my answers to be traced back to me. This can affect my customer relations. I ask you to please confirm whether the information was shared in a way that ties the responses to my email address.

I require full disclosure of the format in which this information was shared, the exact time-frame and method via which it was made available, and a full log of who accessed this information (such as web server logs).

I understand that before reporting my concern to the Estonian Data Protection Inspectorate I give you the chance to deal with it. If, when I receive your response, I would still like to report my concern to the Estonian Data Protection Inspectorate, I will give them a copy of it to consider.

Best regards,

Stefanie

Timescale Answered

Dear Stefanie,   I have attached to this email a spreadsheet highlighting all the data that we received from you when you filled out the survey. As you can see, only your email address was included with this information, not your name or any other identifying information. This data had been available for download on our website in one larger spreadsheet, along with submission data from other survey participants, but was removed within minutes once we learned that email addresses were contained in the document.

We have contacted all partners who may have had access to the survey data, and instructed them to delete or recall the data. I can confirm that the data is no longer publicly available.

We deeply regret any inconvenience this may have caused and are committed to ensuring such incidents do not occur in the future. We have already implemented remedial measures to prevent this error from occurring again.

Please feel free to contact our General Counsel with any additional questions at mail address removed.

What Has Been Leaked

According to https://webcf.waybackmachine.org/web/20250116072635/https://www.timescale.com/state-of-postgres/2024 the raw data was available for downloads at least until 16th of January 2025. The raw data has not been archived.

The download is not available on newer snapshots on the wayback machine.

This is what so far is known about the leak. The email by Timescale is very vague about what and how long the data has been leaked.

Sorry

I feel sorry, that I supported that survey and motivated people to answer Timescales survey with my blog post https://proopensource.it/blog/timescale-postgresql-survey-2024 from 27th of September 2024.

Not only did Timescale made your personal data available, all the survey data including your personal data has been leaked.

If I would have known, that this company didn’t take care of your data, I would not have encouraged you to participate in said survey.

Conclusion

I will not participate in any future Timescale survey as the trust into handling sensitive data is destroyed. And of course I will not encourage other people to take surveys published by other companies.

---

Author: Stefanie Janine Stölting