Security at Formclick
Your forms collect information from your customers, so we treat it carefully. This page describes the controls Formclick uses today, where your data is hosted, and how to report a security issue.
Protecting your data
Encryption in transit
All Formclick sites and the submission API are served over HTTPS only, with HTTP Strict Transport Security (HSTS) so browsers never fall back to plain HTTP.
Encryption at rest
Data is stored on encrypted infrastructure. Secrets you give us, such as integration credentials, database connection strings, webhook secrets and captcha secret keys, are additionally encrypted with AES-256-GCM before they are stored, and are never shown back in full.
Your data, your control
You can delete individual submissions at any time. We do not sell submission data or use it for advertising.
Account protection
Password storage
Passwords are stored only as bcrypt hashes, never in plain text. Sign-in with Google or Microsoft is also available.
Two-factor authentication
You can turn on two-factor authentication for your Formclick account.
Secure sessions
Session cookies are HttpOnly and Secure, so page scripts cannot read them and they are only sent over HTTPS. Account and dashboard pages refuse to load inside other websites’ frames, which blocks clickjacking.
Team permissions
Workspace members get role-based permissions, so teammates can view or edit forms without full account access.
Spam and abuse controls
Built-in spam filtering
Every plan includes a spam filter and honeypot field support, and the submission API is rate limited.
Captcha
Google reCAPTCHA (v2 and v3) and Cloudflare Turnstile are supported from the Starter plan.
Domain restriction
Limit a form to accept submissions only from your own websites (Starter plan and above).
Public access keys
The access key in your form can only be used to submit to that form. It cannot read submissions or change settings.
Safe outbound requests
Webhook and integration URLs are checked when you save them: addresses on private networks, localhost and cloud metadata endpoints are rejected.
Hosting and infrastructure
Formclick runs on established cloud providers. Customer data is stored in the United States.
| Provider | Used for |
|---|---|
| Vercel | Hosting the Formclick website and app |
| Neon (on AWS, US East) | Database for accounts, forms and submissions |
| Amazon Web Services (US East) | File upload storage and email delivery |
| Paddle | Subscription billing. Card details are handled by Paddle and never reach Formclick. |
Compliance
Formclick does not currently hold SOC 2 or ISO 27001 certification, and it does not offer HIPAA agreements. For GDPR questions, a Data Processing Agreement, or a data request, email support@formclick.io. Our Privacy Policy explains what we collect and why.
Report a vulnerability
If you believe you have found a security issue in Formclick, email support@formclick.io with “Security report” in the subject, including steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and do not access other people’s data, disrupt the service, or run automated scans that degrade it.
Keep your HTML. Let Formclick handle the rest.
Free plan, no credit card. Your first form can be live in a few minutes.
Get started free