Skip to main content
FormAI is built to protect your forms, your responses and your respondents’ data. This page sums up how, and gives security researchers a direct way to report a vulnerability. For the full detail, read Security and privacy.

​
Security at a glance

EU data residency

Every plan, including Free, is hosted in the European Union.

Encryption

Data is encrypted in transit with TLS and encrypted at rest.

Credentials and sessions

Passwords are stored as bcrypt hashes, and sessions use JWT family rotation.

Access control

Role-based access control on every plan, with workspaces isolated from one another.
FormAI is GDPR-aligned on every plan. SOC 2 is on the roadmap.

​
Report a vulnerability

If you believe you have found a security vulnerability in FormAI, report it with the form below. It takes about a minute.
If the form doesn’t load (some privacy settings and browsers such as Brave block embedded forms), open it in a new tab or email security@formai.app.

​
Make your report useful

  • Describe the issue and where it occurs: the page, feature or endpoint.
  • Include clear steps to reproduce it.
  • Explain the potential impact.

​
Disclose responsibly

  • Test only with your own account and your own data. Don’t access, change or delete anyone else’s.
  • Give the team a reasonable opportunity to investigate and fix the issue before you disclose it publicly.

​
Learn more

Security and privacy

Data residency, encryption, access control and compliance in detail.

Privacy Policy

How your data is handled, and the current list of sub-processors.