Our ESOMAR 37 Responses Just Got an Update

ROI Rocket just published an updated set of ESOMAR 37 responses — here’s what changed and why it’s worth a look if you’re evaluating sample partners this year.

---

If you buy online sample, there’s a good chance you’ve never actually read your provider’s ESOMAR 37 responses. Most buyers haven’t. Most providers count on that.

ROI Rocket just published an updated set — and rather than let it sit quietly on a compliance page, this post walks through what’s changed and why it’s worth a look if you’re evaluating sample partners this year.

What ESOMAR 37 actually is

For anyone who hasn’t run into it: ESOMAR 37 is a standard set of 37 questions designed to help buyers evaluate the quality, sourcing, and integrity of online sample. It covers everything from where panelists come from, to how identity is verified, to what happens when a project can’t be completed as planned. Most providers will answer it if asked. Fewer publish it proactively.

ROI Rocket publishes its responses in full because buyers deserve specifics, not a sales pitch.

What’s new in this update

The most significant change is on the fraud detection side. ROI Rocket’s identity verification process now runs on two complementary platforms rather than one. Mastercard identity cross-references a prospective member’s name, email, phone, and location against a broad network of identity signals at the point of recruitment. Verisoul adds a second, independent layer — device fingerprinting, behavioral biometric analysis, bot detection, and VPN/proxy identification — applied in real time at the point of survey entry, across every source: proprietary panel, Pinecone Research, specialty communities, and intercept-recruited participants alike.

That combination matters because the two platforms are catching different things. Identity verification confirms a person is real and who they claim to be. Verisoul catches the fraud patterns that show up after enrollment — shared devices, coordinated account activity, automated entry. Layering both closes a gap that either one alone would leave open.

The updated responses also go further on source transparency: exactly what happens when a project needs supplemental third-party sample, how those partners are vetted before they’re ever deployed, and what gets disclosed to buyers before and during fieldwork — not after. And they reflect ROI Rocket’s current compliance posture in full: SOC 2 Type II certification across all five Trust Services Criteria, and certification under the EU/UK/Swiss Data Privacy Framework for cross-border data transfer.

Why we’re telling you this now

Sample quality conversations tend to happen after something’s gone wrong — a tracking study that drifted, a project that got flagged for fraud, a client asking hard questions about panel composition. Better to have this conversation before that point.

Over the next several weeks, ROI Rocket will publish a short series digging into specific pieces of its ESOMAR 37 responses — the questions buyers should be asking, how the sampling methodology actually works, and what the verification stack looks like end to end. This post is the starting gun.

The full ESOMAR 37 document is available by contacting research@roirocket.com.