Skip to content

Security

How FormsAI keeps your data safe.

Encryption, careful sign-in, private files and checks on every request, on infrastructure that’s backed up every night.

Data in transit and at rest

  • Everything is served over HTTPS, including forms on custom domains, where certificates are issued automatically.
  • Stripe keys and Google access are encrypted at rest with AES-256-GCM.
  • API keys are stored only as hashes, and passwords as salted hashes.
  • FormsAI runs on Cloudflare, with nightly backups.

Sign-in and access

  • Two-factor sign-in with an authenticator app, with recovery codes.
  • Sign in with Google or Apple, if you prefer.
  • Sessions are HttpOnly cookies, so scripts on the page can’t read them.
  • Every request for your data is checked against your account and your team role: owner, editor or viewer.
  • Uploaded files are private, served only to you and your team.

Public forms

  • Cloudflare Turnstile, a honeypot, rate limits and a speed and link check keep spam out.
  • Password-protected forms check the password on the server; it’s never sent to the browser.
  • Payment amounts are worked out again on the server, and card details go straight to Stripe.
  • Logic is re-run on the server for every submission, so scores and paths can’t be faked.
  • No IP addresses are stored and public forms set no tracking cookies.

For developers

  • Webhooks are signed with HMAC-SHA256 so your server can check they’re genuine.
  • API keys can be revoked at any time, and each key is limited to 60 requests a minute.
  • Strict content security policy and security headers on every page.

Compliance

For answers people give your forms, you’re the controller and FormsAI is your processor. The data processing agreement at /dpa applies to every account, and the privacy policy lists who helps run FormsAI. FormsAI isn’t HIPAA compliant, so don’t collect protected health information with it.

Found a security problem? Email support@shaheercare.com and we’ll respond quickly.

FAQ

Security, answered

Is FormsAI GDPR compliant?

FormsAI acts as your processor for respondents’ answers under a data processing agreement that applies to every account. You stay responsible for telling respondents what you collect and why.

Does FormsAI store IP addresses?

No. Public forms don’t store respondents’ IP addresses and set no tracking cookies.

Is FormsAI HIPAA compliant?

No. Don’t collect protected health information with FormsAI.

Where is my data stored?

On Cloudflare: its database, storage and network, with nightly backups.

Make your first form in minutes.

Free forever plan with 3 active forms and 100 responses a month. No card needed.

Start free