This page describes how formto protects the data your forms collect.

Infrastructure

formto runs on Cloudflare Workers. Responses and their files are stored with Cloudflare (D1 and R2), and every connection to formto uses HTTPS.

Accounts

Passwords are stored only as salted hashes. Repeated failed sign-ins lock password sign-in for a while, and you can always sign in with an emailed link instead. Every workspace's data is filtered by workspace on every query, so one workspace cannot read another's.

Secrets and deliveries

Webhook signing secrets and connected-account tokens are encrypted with AES-256-GCM, bound to the row they belong to. Webhooks are signed with the Standard Webhooks scheme so your receiver can verify each one. formto refuses to send deliveries to private, internal or loopback addresses.

Files

Uploaded files are downloadable only through links that carry a per-file token.

Payments

Card details never reach formto: checkout and billing run on Stripe's hosted pages.

Reporting a vulnerability

If you find a security problem, please tell us privately at the address listed on formto.io before disclosing it. We will confirm we received it and keep you updated while we fix it.