Security
Secure by design, private by default
People share personal information through your forms. Here is exactly how we protect it.
Encrypted at rest
Answers and files are encrypted with AES-256-GCM using keys bound to each record.
Verified uploads
Files are checked by magic bytes, never trusted by name. Optional ClamAV malware scanning.
Abuse protection
Rate limiting, honeypots and optional CAPTCHA keep spam and brute force away.
SSRF-safe webhooks
Outbound calls are pinned to public IPs, signed with HMAC-SHA256 and retried with backoff.
Least privilege
Scoped API keys, hashed at rest. Admins manage accounts but can’t read your responses.
Audit trail
Security-relevant actions — keys, exports, admin changes — are recorded in an audit log.
Data retention
Automatically delete responses after N days. Export or erase your data at any time.
Private by default
Expected answers stay server-side, password-protect forms, and download files as attachments only.
Data protection
- Respondent answers, uploaded files, file names and webhook payloads are encrypted with AES-256-GCM. Each ciphertext is bound to its record, so it cannot be moved to another one.
- Encryption keys are supplied by the operator and support rotation (old data stays readable while new data uses the new key).
- IP addresses are never stored in clear text — only keyed hashes for abuse prevention.
- Expected answers of approval workflows never leave the server.
Authentication & access
- Sign-in, MFA and session management by Clerk. The API verifies every session token (RS256) and its authorized origin.
- API keys are random 40-character secrets shown once and stored only as HMAC-SHA256 hashes. Scopes limit what each key can do.
- API keys cannot manage keys, webhooks or billing, and browsers cannot use them (strict CORS).
- Administrators can manage accounts and stop abuse, but there is no admin endpoint that reveals respondent answers. Admin actions can require MFA.
Upload safety
- Owners choose allowed formats per question; uploads are verified by their content (magic bytes), not by their name.
- Optional ClamAV scanning rejects malware before it is stored.
- File names are sanitized; downloads are always served as attachments with a sandboxing Content-Security-Policy.
- Uploads are single-use and expire after 24 hours unless attached to a submission.
Application hardening
- Strict validation of every form definition and submission: unknown fields are dropped, sizes are capped, regular expressions are linear-time.
- Rate limiting per IP, per form, per user and per API key; honeypots and optional Cloudflare Turnstile CAPTCHA.
- Webhooks only reach public IP addresses (checked at connection time to defeat DNS rebinding), never follow redirects, and are signed.
- CSV exports neutralize spreadsheet formulas; strict security headers (CSP, HSTS, frame protection) on every page.
Privacy & compliance tools
- Export all your forms and responses (CSV/JSON) at any time.
- Automatic data retention deletes responses after a period you choose.
- Deleting your account erases your forms, responses and files.
- An audit log records security-relevant actions such as key creation, exports and admin changes.
Responsible disclosure
Found a vulnerability?
Please email support@createaform.app with details and steps to reproduce. We respond within two business days and never take legal action against good-faith research.
Your next form can approve itself.
Start free in under a minute. No credit card required.