Enterprise-grade data protection by default.
We treat security as a core foundation. Every submission, asset, and key is stored with robust security measures to guarantee that data remains private and protected at all times.
All data is housed in isolated Postgres databases inside Supabase, guarded by strict Row-Level Security (RLS) rules. This guarantees that team members can only access records they have explicit roles to view.
Submission transfers are encrypted using TLS 1.3, and all databases are encrypted at rest with AES-256 keys. We conduct weekly automated dependency audits and fix vulnerabilities within 24 hours.
To align with global privacy mandates like GDPR and CCPA, FormTo.Link does not store plain IP addresses. Instead, we hash the IP addresses on our server using cryptographic algorithms.
This supports anti-spam mechanisms and helps identify duplicate entries while protecting the respondent's personal identity. You can collect data globally without violating privacy laws.
Workspace collaboration is isolated at the database level. Every action—from form changes to API requests—requires a valid JWT token. You can configure multi-factor auth (MFA) to lock down manager access.
We maintain audit records containing action prefixes and timestamps. This ensures security administrators can verify access and trace configuration changes across the platform.
Gather employee reviews with peace of mind knowing results are restricted to verified admins.
Collect signups and contact info via forms compliant with strict European privacy rules.
Obtain document uploads securely stored in access-restricted cloud storage buckets.
Yes. All uploaded documents are stored in secure buckets. Download links are short-lived and expire after a configurable duration to prevent leaks.
Yes. Administrators can trigger a complete deletion request for any form or response, purging all matching records from our backups within 72 hours.