Security

• Every connection to FlowyForm, including forms, the app and the API, uses HTTPS with HSTS, so browsers refuse unencrypted connections.
• Uploaded files are stored in DigitalOcean Spaces, which encrypts data at rest.
• Slack and Google tokens for integrations are encrypted in our database with AES-256-GCM.
• Webhooks can be signed with a secret you choose (an HMAC-SHA256 signature in the x-flowyform-signature header), so your endpoint can check a request really came from FlowyForm.

• Passwords are hashed with Argon2id. We never store or see the password itself.
• You can sign in with Google instead of a password.
• Sign-in attempts are rate-limited per network and per account, which slows down password guessing.
• Session cookies are HttpOnly, Secure and SameSite, so page scripts cannot read them. Sessions end 30 days after last use. In settings you can see every signed-in device and sign any of them out.
• Email changes and password resets use single-use codes and links that expire.

• Files respondents upload are private. They open only through short-lived signed links, for members of the form’s workspace.
• Files uploaded to a form that is never submitted are deleted after 3 days.
• Webhook addresses are checked before every delivery, so they cannot be pointed at FlowyForm’s internal network or other private addresses.
• Google Sheets access uses the narrow drive.file permission: FlowyForm can reach only the spreadsheets it creates or that you choose.

• Text that form owners write is sanitised, so a form cannot inject scripts into respondents’ browsers.
• Forms can be protected with a password, and can close at a set date or after a number of responses.
• Each response is checked for signs of spam (hidden honeypot fields, impossible speed, bursts from one network, duplicates, link-stuffing). Suspicious responses are set aside for you to review rather than deleted.
• Submissions and uploads are rate-limited per network.
• The app cannot be framed by other websites, which blocks clickjacking.

• FlowyForm runs in containers on DigitalOcean in North America. Only the web server is exposed to the internet; the database and job queue are on a private network.
• The database is backed up every 6 hours and backups are kept for 14 days, so data can be restored after a failure. Older backups are deleted automatically.
• Payments are handled entirely by Stripe; card details never reach our servers.

Only a small number of FlowyForm staff have administrative access. They use it for support, abuse investigations and keeping the service running. Signing in as a customer to troubleshoot lasts at most 60 minutes, and every staff action on an account is logged.

So you can decide with full information:

• We do not currently hold SOC 2, ISO 27001 or similar certifications.
• We do not sign HIPAA business associate agreements, and FlowyForm is not built to PCI DSS standards for card data.
• Responses are encrypted in transit and protected by access controls. They are not end-to-end encrypted; FlowyForm’s servers can read them in order to deliver them.
• Two-factor authentication is not available yet. Signing in with Google lets you use Google’s two-step verification.

If you need any of these, tell us at help@flowyform.com; it helps us decide what to build next.

If you find a security problem, email help@flowyform.com with the subject “Security”. Please give us a reasonable chance to fix it before telling anyone else. Do not access or change other people’s data, and do not run tests that could degrade the service. We will not pursue legal action against anyone who reports in good faith along these lines, and we will tell you when it is fixed. Our Acceptable Use Policy applies to everything else.