Skip to content
Create a Form

Account & operations

Security & privacy

How data is protected and the tools you have to stay compliant.

Encryption

  • Answers, file contents, file names, webhook secrets and webhook payloads are encrypted at rest with AES-256-GCM.
  • Each ciphertext is bound to its record (authenticated data), so data can’t be swapped between records.
  • Operators can rotate encryption keys without downtime.

Access control

  • Signing in is handled by Clerk (passwords, social logins, MFA). The API verifies every session token.
  • API keys have scopes, can expire, are shown only once and are stored as keyed hashes. They can’t manage keys, webhooks or billing.
  • Administrators can manage accounts, plans and abusive forms, but there is no admin endpoint that exposes your respondents’ answers.

Abuse protection

  • Rate limits per IP, per form, per account and per API key.
  • Hidden honeypot field on every form; optional CAPTCHA (Cloudflare Turnstile).
  • Uploads verified by content, optional malware scanning.
  • Webhooks can only reach public internet addresses and never follow redirects (SSRF protection).

Privacy tools

  • Export your forms and responses at any time (CSV/JSON, plus a full account export).
  • Data retention: delete responses automatically after N days (Pro).
  • Account deletion erases all your forms, responses and files.
  • IP addresses are stored only as keyed hashes.
  • An audit log records sensitive actions.

Your responsibilities

You decide what data your forms collect. Only ask for what you need, tell respondents how you use it (link your privacy notice in the form description), and don’t collect payment card numbers or passwords through forms.