> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> How FormAI protects your forms and responses: EU data residency, encryption, access control, GDPR alignment, AI and your data, and compliance status.

FormAI is built to protect your forms, your responses and your respondents' data. This page summarizes how. The [Privacy Policy](https://formai.app/privacy-policy) and [Terms of Service](https://formai.app/terms-of-service) are the authoritative statements of how your data is handled.

## Security at a glance

* **EU data residency on every plan**, including Free.
* **Encrypted in transit and at rest.**
* **Credentials and sessions:** passwords are stored as bcrypt hashes, and sessions use JWT family rotation.
* **Role-based access control** on every plan.
* **GDPR-aligned** on every plan. SOC 2 is on the roadmap.

## Data residency

All workspaces are hosted in the European Union, and data remains within EU jurisdiction. Hosting uses IONOS (Germany), Supabase (Frankfurt region) and Cloudflare R2 (EU region).

The full, current list of sub-processors is published in the [Privacy Policy](https://formai.app/privacy-policy) and updated when it changes.

If a transfer outside the EU ever becomes necessary, FormAI applies appropriate safeguards, including standard contractual clauses approved by the European Commission.

## Encryption

* **In transit:** every connection to FormAI is encrypted with TLS.
* **At rest:** form definitions, responses and uploaded files are encrypted at rest in EU-hosted storage.
* **Credentials:** account passwords are never stored in plain text. They are stored as bcrypt hashes.
* **Sessions:** sessions use JWT family rotation, so a stolen token cannot be replayed indefinitely.

## Access control

Role-based access control is included on every plan. Each member of a workspace holds a role that determines what they can see and change, and workspaces are isolated from one another. Data in one workspace is not reachable from another.

As good practice, give people the least access they need and review the member list when someone changes team. See [Invite your team](/user-guide/workspaces/invite-your-team) for the available roles.

## GDPR and your data

FormAI is designed around the GDPR principles of lawfulness, purpose limitation, data minimization, accuracy, storage limitation and accountability. In practice:

* **You own your content.** You retain ownership of every form and response you create.
* **Deletion.** Individual responses, whole forms and entire accounts can be deleted. Anyone can submit a request through the [data deletion request page](https://formai.app/privacy/delete).
* **Sub-processors are published** in the [Privacy Policy](https://formai.app/privacy-policy).
* **A signed DPA** is available on the Enterprise plan.

## AI and your data

FormAI's AI features process the content of your forms and responses in order to work. This applies to form generation, FormAI Agent and AI theme generation.

* **No training without consent.** FormAI does not use your content to train machine learning models without your explicit, opt-in consent.
* **Same rules apply.** Content processed by AI features is covered by the same EU hosting and encryption commitments described above.

<Note>
  AI can make mistakes. Review generated content before you publish it.
</Note>

## Compliance status

| Standard | Status |
| - | - |
| GDPR | Aligned on every plan, with EU data residency included |
| SOC 2 | On the roadmap |

The [pricing page](https://formai.app/pricing) is authoritative on which plan includes which capability.

## Report a security issue

If you believe you have found a vulnerability in FormAI, report it responsibly.

* Use the [vulnerability report form](/security#report-a-vulnerability), or email [security@formai.app](mailto:security@formai.app), with a description, reproduction steps and the potential impact.
* Give the team a reasonable opportunity to investigate and fix the issue before you disclose it publicly.

The [contact page](https://formai.app/contact) lists other ways to reach the team.

## Next steps

<CardGroup cols={2}>
  <Card title="Invite your team" icon="user-plus" href="/user-guide/workspaces/invite-your-team">
    Roles and invitations for your workspace.
  </Card>

  <Card title="Plans and AI credits" icon="credit-card" href="/user-guide/account/plans-and-ai-credits">
    See what each plan includes.
  </Card>

  <Card title="Roadmap" icon="rocket" href="/user-guide/roadmap">
    See what is planned.
  </Card>

  <Card title="FAQ" icon="circle-question" href="/user-guide/faq">
    Quick answers to common questions.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.