Security and privacy

FormAI is built to protect your forms, your responses and your respondents’ data. This page summarizes how. The Privacy Policy and Terms of Service are the authoritative statements of how your data is handled.

​

Security at a glance

• EU data residency on every plan, including Free.
• Encrypted in transit and at rest.
• Credentials and sessions: passwords are stored as bcrypt hashes, and sessions use JWT family rotation.
• Role-based access control on every plan.
• GDPR-aligned on every plan. SOC 2 is on the roadmap.

​

Data residency

All workspaces are hosted in the European Union, and data remains within EU jurisdiction. Hosting uses IONOS (Germany), Supabase (Frankfurt region) and Cloudflare R2 (EU region). The full, current list of sub-processors is published in the Privacy Policy and updated when it changes. If a transfer outside the EU ever becomes necessary, FormAI applies appropriate safeguards, including standard contractual clauses approved by the European Commission.

​

Encryption

• In transit: every connection to FormAI is encrypted with TLS.
• At rest: form definitions, responses and uploaded files are encrypted at rest in EU-hosted storage.
• Credentials: account passwords are never stored in plain text. They are stored as bcrypt hashes.
• Sessions: sessions use JWT family rotation, so a stolen token cannot be replayed indefinitely.

​

Access control

Role-based access control is included on every plan. Each member of a workspace holds a role that determines what they can see and change, and workspaces are isolated from one another. Data in one workspace is not reachable from another. As good practice, give people the least access they need and review the member list when someone changes team. See Invite your team for the available roles.

​

GDPR and your data

FormAI is designed around the GDPR principles of lawfulness, purpose limitation, data minimization, accuracy, storage limitation and accountability. In practice:

• You own your content. You retain ownership of every form and response you create.
• Deletion. Individual responses, whole forms and entire accounts can be deleted. Anyone can submit a request through the data deletion request page.
• Sub-processors are published in the Privacy Policy.
• A signed DPA is available on the Enterprise plan.

​

AI and your data

FormAI’s AI features process the content of your forms and responses in order to work. This applies to form generation, FormAI Agent and AI theme generation.

• No training without consent. FormAI does not use your content to train machine learning models without your explicit, opt-in consent.
• Same rules apply. Content processed by AI features is covered by the same EU hosting and encryption commitments described above.

​

Compliance status

The pricing page is authoritative on which plan includes which capability.

​

Report a security issue

If you believe you have found a vulnerability in FormAI, report it responsibly.

• Use the vulnerability report form, or email security@formai.app, with a description, reproduction steps and the potential impact.
• Give the team a reasonable opportunity to investigate and fix the issue before you disclose it publicly.

The contact page lists other ways to reach the team.

​

Next steps