---
title: "Security — formformform"
description: "How formformform keeps your data safe: AES-256 encryption at rest, TLS 1.2+ in transit, EU-only hosting, and GDPR-aligned security built into every layer."
url: "https://www.formformform.com/security"
type: static
generatedAt: "2026-08-23T18:56:58.727Z"
---
# Security

Your data is encrypted, protected, and hosted in the EU. Security isn't an add-on — it's how we build.

Encryption everywhere

All connections to formformform are encrypted with TLS 1.2+ (HTTPS). We enforce HTTPS on every endpoint — there is no way to access formformform over an unencrypted connection. Data at rest is encrypted using AES-256.

End-to-end encryption, when at-rest isn't enough

TLS and AES-256 protect data in transit and on our disks — but our servers still see those responses in the clear. For the submissions that truly can't leak — legal client intake, patient questionnaires, whistleblower reports, source tips — [end-to-end encrypted forms](https://www.formformform.com/encrypted-forms) seal each answer in the respondent's browser to your own public key. We store only ciphertext and never hold the key to read it, so a breach of our systems exposes nothing readable. See [who relies on it and why](https://www.formformform.com/encrypted-forms).

EU-hosted infrastructure

All formformform infrastructure is hosted in the European Union. Your data never leaves the EU. We use trusted cloud providers with SOC 2 Type II and ISO 27001 certifications.

HTTPS-only embeds

Embedded forms are served exclusively over HTTPS. The embed script loads from our CDN with subresource integrity (SRI) hashes to prevent tampering. No mixed content, no exceptions.

Authentication & access control

Passwords are hashed using bcrypt. Sessions are secured with HTTP-only cookies and short-lived tokens. Enterprise plans support SAML-based single sign-on.

Backups & availability

Databases are backed up daily with point-in-time recovery. Backups are encrypted and stored in a separate availability zone. Our target uptime is 99.9%.

Responsible disclosure

Found a vulnerability? We take security reports seriously. Contact us at [hello@formformform.com](mailto:hello@formformform.com) and we'll respond within 48 hours.