How Formcrest protects your account, your forms, and the data your submitters send.

Security is built into Formcrest rather than bolted on afterwards. This page describes the controls that are live today. We keep it accurate to what is actually implemented, and we update it as the product evolves.

Transport security

Every connection to Formcrest is served over HTTPS. We enforce HTTP Strict Transport Security (HSTS) so browsers refuse to connect over plain HTTP, and all traffic to our form endpoints, dashboard, and API is encrypted in transit. Session cookies are set with the Secure, HttpOnly, and SameSite attributes, so they are only sent over HTTPS, are not readable by JavaScript, and are protected against cross-site request forgery.

Authentication and passwords

We use session-cookie authentication. When you sign in, we issue a long, random session identifier stored in a secure, HttpOnly cookie. Passwords are never stored in plaintext and are never written to logs. Each password is hashed with PBKDF2-SHA256 using 210,000 iterations and a unique per-user salt before it is stored, following current OWASP guidance.

We also rate-limit authentication: repeated failed sign-in attempts trigger temporary account lockouts, which blunts password-guessing and credential-stuffing attacks.

Encryption at rest

Every application secret is held in Cloudflare Workers Secrets — never committed to source control or stored in plaintext configuration files. When you connect a third-party integration, the OAuth tokens we store on your behalf are encrypted at rest.

Application security

Rate limiting. Form submissions are limited both per IP address and per form, and the dashboard API and sign-in flows have their own limits. This protects your forms from abuse and floods.
Spam filtering. We combine a hidden honeypot field with Cloudflare Turnstile to filter out automated spam without forcing intrusive challenges on real visitors.
SSRF protection on webhooks. When outbound webhooks ship (a Pro feature), each delivery resolves the destination hostname first and refuses to connect to private, loopback, or link-local IP addresses, so webhooks cannot be used to reach internal systems.
File-upload validation. When file uploads ship, uploaded files are validated by inspecting their actual contents (magic bytes) rather than trusting the file extension, and executable and script types are blocked.

Data residency and isolation

Formcrest stores customer data in the European Union. Our primary database runs on Cloudflare D1 in the Western Europe region, and transactional email is sent through AWS SES in eu-west-1. Keeping data and processing within the EU supports our GDPR commitments. See our subprocessors page for the full list of vendors and their roles.

Backups and recovery

Our database uses Cloudflare D1 point-in-time recovery, so we can restore to an earlier moment if data is lost or corrupted. Object storage on Cloudflare R2 has versioning enabled, so overwritten or deleted objects can be recovered. These measures back our recovery-time and recovery-point objectives for restoring service after an incident.

Audit logging

Security-sensitive account events, such as sign-ins, password changes, plan changes, API-key creation and revocation, and account deletion, are recorded in an audit log. This gives us a traceable record for investigating suspicious activity and responding to incidents.

Roadmap

Two-factor authentication (2FA) is planned but not yet available in v1. We will announce it here and in the dashboard when it ships.

Responsible disclosure

If you believe you have found a security vulnerability in Formcrest, please email info@formcrest.com with the details and steps to reproduce. We will acknowledge your report, investigate, and keep you informed. Please give us a reasonable opportunity to remediate before any public disclosure, and avoid accessing or modifying other users' data while testing.

For live service and uptime information, see our status page.

Learn more

For how we handle personal data, see our Privacy Policy. For the third parties involved in operating Formcrest, see our Subprocessors page.