> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How FormAI protects your data, and how to report a security vulnerability responsibly.

FormAI is built to protect your forms, your responses and your respondents' data. This page sums up how, and gives security researchers a direct way to report a vulnerability. For the full detail, read [Security and privacy](/user-guide/security-and-privacy).

## Security at a glance

<CardGroup cols={2}>
  <Card title="EU data residency" icon="earth-europe">
    Every plan, including Free, is hosted in the European Union.
  </Card>

  <Card title="Encryption" icon="lock">
    Data is encrypted in transit with TLS and encrypted at rest.
  </Card>

  <Card title="Credentials and sessions" icon="key">
    Passwords are stored as bcrypt hashes, and sessions use JWT family rotation.
  </Card>

  <Card title="Access control" icon="users">
    Role-based access control on every plan, with workspaces isolated from one another.
  </Card>
</CardGroup>

FormAI is GDPR-aligned on every plan. SOC 2 is on the roadmap.

## Report a vulnerability

If you believe you have found a security vulnerability in FormAI, report it with the form below. It takes about a minute.

<Frame>
  <iframe src="https://ui.formai.app/to/8d7B3e0rT0Kh2Be8gCYb9A" title="Report a security vulnerability" width="100%" height="680" style={{ border: 0 }} />
</Frame>

If the form doesn't load (some privacy settings and browsers such as Brave block embedded forms), [open it in a new tab](https://ui.formai.app/to/8d7B3e0rT0Kh2Be8gCYb9A) or email [security@formai.app](mailto:security@formai.app).

### Make your report useful

* Describe the issue and where it occurs: the page, feature or endpoint.
* Include clear steps to reproduce it.
* Explain the potential impact.

### Disclose responsibly

* Test only with your own account and your own data. Don't access, change or delete anyone else's.
* Give the team a reasonable opportunity to investigate and fix the issue before you disclose it publicly.

## Learn more

<CardGroup cols={2}>
  <Card title="Security and privacy" icon="shield-halved" href="/user-guide/security-and-privacy">
    Data residency, encryption, access control and compliance in detail.
  </Card>

  <Card title="Privacy Policy" icon="file-lines" href="https://formai.app/privacy-policy">
    How your data is handled, and the current list of sub-processors.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.