Security
FormDoc receives other people’s messages on your behalf, so protecting them is the core of the product. This page explains how submissions are stored, who can see them, and how to report a security problem.
Submissions are encrypted before they’re stored
- Encryption at rest. Each submission is encrypted with AES-256-GCM before it reaches the database, using its own data key. Data keys are wrapped by a master key held outside the database, and keys can be rotated.
- Data in India. The database is in Mumbai (ap-south-1). Requests are handled by Cloudflare at the location nearest the visitor.
- HTTPS everywhere. Every FormDoc address uses HTTPS with HSTS, so browsers never connect without encryption.
- Automatic deletion. Submissions are deleted when your plan’s history period ends: 30 days on Free, 1 year on Pro and 3 years on Agency, or sooner if you delete them.
- IP addresses are hashed. A visitor’s IP address is never stored. FormDoc keeps only a one-way hash that changes every day, which is enough to limit floods and spot abuse.
Who can see your submissions
| Who | What they can see |
|---|---|
| You and your team | Submissions for your forms, by role: owners, admins, members and read-only viewers |
| The recipients you confirm | The notification email for each submission |
| FormDoc staff | Account and usage details for support. The admin area can’t read submission content, and staff need a two-factor code to open it |
| Anyone with your access key | Nothing. The key is public by design: it only lets people send you a submission |
Every change in a workspace, such as settings, team members or API tokens, is recorded in an audit log you can read in the dashboard.
Accounts and keys
- Sign-in uses a one-time email link or Google. FormDoc stores no passwords.
- Sessions use secure, HTTP-only cookies, and requests that change data must come from the FormDoc dashboard itself.
- API tokens for the command-line tool are shown once and stored only as a hash. Revoke them at any time.
- Captcha secrets you add to a form are encrypted, and are never shown again after you save them.
Protecting your inbox and your site
- Spam layers. A hidden honeypot, spam scoring and rate limits stop most junk before it reaches you, and spam is never emailed. Read how FormDoc stops form spam.
- Trusted domains (Pro): accept submissions only from your own websites.
- Safe redirects. Thank-you redirects must be http(s) addresses, and with trusted domains they must point at your own sites, so a form can’t be used to send people elsewhere.
- Signed webhooks. Each webhook request carries an HMAC signature, so your server can check it came from FormDoc. Webhooks go only to https addresses on the public internet, never to internal networks.
- Email reputation. Addresses that bounce or complain stop receiving email automatically.
Service providers
FormDoc uses a small number of providers: Cloudflare (hosting and network), Supabase on AWS (database, Mumbai), Resend (email), and, only when you connect them, Google, Slack and payment providers. The full list, with locations, is in the privacy policy. Customers who need a data processing agreement can read the DPA.
Report a security problem
If you think you’ve found a vulnerability, please tell us before telling anyone else. Use the contact form, start your message with the word “Security”, describe what you found and how to reproduce it, and include a way to reach you. We’ll reply as soon as we can, keep you updated, and credit you if you’d like once it’s fixed.
Please don’t access other people’s data, disrupt the service, or send spam to test it. The same details are published in our security.txt file.