Security

Signing in

• Email links work once and run out after 10 minutes. We keep only a scrambled copy of the link's secret, so nobody reading our database could use it to sign in.
• Passkeys let you sign in with Face ID, a fingerprint, a PIN or a password manager. They need your device and you, so they count as two factors in one step. We keep only the public half, which is no use to anyone else. We email you whenever one is added.
• Passwords are optional. We keep a salted, one-way scrambled version, never the password. Setting, changing or removing one signs out your other devices and emails you.
• After 10 wrong passwords in a row, password sign-in for that address pauses for 15 minutes and we email the account's owner. The email link still works, so you can't be locked out of your own account.
• A bot check and a limit on tries protect every sign-in. Our answers never say whether an address has an account.

Keeping your data separate

• Everything we look up is tied to the account that owns it. Another account's form looks exactly like one that doesn't exist.
• In a Pro project you choose what people can do: editors build, viewers look. Only the owner sees responses through the link's page and the API.
• API keys are shown once, only read, and can be revoked at any time.

Responses

• A response is stored with its answers and when it was sent. It doesn't hold the sender's name, email or address.
• Anyone with a form's link can answer it, so use a password, allowed emails or a response limit when a form needs them.
• Webhook addresses are only recorded by host, because the rest of the address can hold a secret.

Encryption and hosting

• The site only works over HTTPS, and tells browsers to keep it that way.
• We run on Cloudflare. Its database and file storage encrypt everything they hold, and the connections between our code and them are encrypted too. Our main database and file storage are placed in Oceania.
• Cloudflare, not us, holds SOC 2 Type II and ISO 27001 certification, and is assessed to PCI DSS every year. Those cover the platform we build on. They aren't certifications of ours.
• Pages carry the usual protective settings: they can't be put inside another site, and they only run scripts from us and our bot check.

Stopping abuse

• Every shared form has a Report this form link, and we look at what's reported.
• The emails we send to people who didn't ask for them are limited to one a day per address.
• Public forms and sign-in sit behind a bot check and rate limits.

Seeing what's happening

• The Activity page shows the account owner who did what: sign-ins, passkeys, API keys, webhooks, deleted forms and responses, downloads, and changes to who is in a project. It never shows what's in a response, and it's kept for a year.
• We watch the site's health and errors, and an automatic check tells us if it goes down.

Backups and deleting

• The database can be wound back to any minute in the last 30 days, which is how we'd recover from a serious mistake. We also save a copy every night and keep it for 35 days. Deleted information can stay in those backups for up to 35 days.
• You can download your responses whenever you like, as CSV, Excel, JSON or PDF.
• If you delete your account, we wait 30 days in case you change your mind, then delete your forms, responses and pictures.

Payments

Payments go through Stripe. You type card details on Stripe's pages, never ours, so we never see or keep a card number.

How we build and fix

• Changes are tested, then tried on a separate copy of the site, before they go live.
• Our build checks the packages we use for known security problems, and does so every week.
• We fix problems by how serious they are: the worst the same day, the next within a week, the rest within a month.
• If something goes wrong that affects your data, we contain it, work out what happened, and tell you straight away. The privacy policy covers data breaches in more detail.

What we don't have yet

We'd rather say it plainly:

• No outside security audit or penetration test yet.
• No certifications of our own. The ones above belong to Cloudflare.
• No second step for password sign-ins. Passkeys are the safer way in, and we recommend them.
• Our data and its backups are with one provider, Cloudflare.

What you can do

• Use a passkey if you can, and keep your email account secure, because it signs you in.
• Treat API keys and webhook addresses like passwords, and revoke the ones you don't use.
• Keep downloads somewhere private. A spreadsheet of responses is outside our protection once it's on your computer.
• Archive links you no longer use, and add a password or allowed emails when a form needs them.
• We never ask for your password by email. If a form asks for something it shouldn't, use Report this form.

Report a problem

If you think you've found a security problem, email security@filloutthisform.com. We'll reply within a few working days, fix it by how serious it is, and thank you. Our security.txt has the details.