Effective May 1, 2026 · v1.2
Security isn't a feature; it's the substrate the rest of FormBridge sits on. This page is the canonical reference for how we protect your data. If something changes, it changes here, and we'll tell you about it.
Overview
- Encryption everywhere. TLS 1.3 in transit; AES-256 at rest. Files are stored with envelope encryption.
- Hosted on Cloudways (Digital Ocean) with redundancy and failover. Production data is region-pinned per account.
- Cloudflare DDoS Protection — distributed denial-of-service attack mitigation.
- Two-factor authentication available now; required for all employees with production access.
- SOC 2 Type II audit in progress. Report expected Q4 2026.
- External penetration test annually, plus a public bug bounty program (see Reporting a vulnerability).
Infrastructure
FormBridge runs on Cloudways (powered by Digital Ocean). Submission data is stored in the region you select on account creation. Data does not leave its primary region except for cross-region disaster-recovery backups, which are encrypted and access-restricted to the on-call team. We use MongoDB for all data storage and maintain code in GitHub with strict access controls.
Our infrastructure is provisioned as code (Terraform). Changes are reviewed, tested in a staging environment, and rolled out in stages with automated rollback. Cloudflare DDoS Protection guards against distributed denial-of-service attacks, providing additional network resilience.
Encryption
- In transit: All connections use TLS 1.3 with strong cipher suites. We don't support TLS 1.0 or 1.1. HSTS is enforced.
- At rest: Databases and object storage encrypt all data with AES-256, with AWS KMS keys. Sensitive fields (webhook secrets, SMTP passwords, API keys) are additionally encrypted at the application layer with envelope encryption.
- Files: Uploaded files are encrypted at rest; download URLs are short-lived and scoped to the requesting user.
- Key rotation: KMS keys rotate automatically. Application-level keys rotate quarterly.
Access control
Production access is restricted to the small number of engineers who need it. Every access requires SSO + hardware-key MFA. Sessions are time-boxed and logged to an immutable audit trail. We use a just-in-time elevation system: standing access is "read minimal logs"; anything more requires a justification recorded against a ticket.
For customers, role-based access control is available on team accounts: Owner, Admin, Member, Viewer. Audit logs surface in the dashboard for the past 90 days.
Application security
- Code review for every change. No solo merges to production.
- Static analysis (Semgrep, GitHub CodeQL) runs on every PR.
- Dependency scanning (Snyk + Dependabot) with auto-patch for known CVEs in non-breaking versions.
- CSP, SRI, and CSRF protections on all dashboard surfaces.
- Rate limiting on submissions and dashboard endpoints, scoped per form and per account.
- Webhook payload signing with HMAC-SHA256 by default.
Incident response
We have a written incident response plan. In the event of a security incident affecting customer data, we will:
- Begin investigation within one hour of detection.
- Notify affected customers within 72 hours of confirming the scope, by email and dashboard banner.
- Publish a post-incident report in the status page within 14 days, with root cause and remediation.
For GDPR-reportable incidents we notify supervisory authorities within the legal 72-hour window.
Compliance & certifications
- GDPR — we offer a DPA on request. EU-based hosting available.
- SOC 2 Type II — audit in progress; report expected Q4 2026.
- ISO 27001 — gap assessment complete; certification expected 2027.
- HIPAA — not currently in scope. Don't use FormBridge to collect PHI.
Email hello@formbridge.ai for our latest security questionnaire (SIG, CAIQ) or to request a DPA.
Reporting a vulnerability
If you believe you've found a security vulnerability, please report it to hello@formbridge.ai. Encrypt with our PGP key (fingerprint A4F9 22B3 7CDE 8F45 1A09 4E2A 5C77 9D6B 3145 88EF) if the issue is sensitive.
We commit to:
- Acknowledge your report within 24 hours.
- Provide an initial assessment within 5 business days.
- Keep you informed during remediation.
- Credit you publicly (with your permission) when the fix ships.
We run a paid bug bounty program in cooperation with HackerOne — see formbridge.ai/security/bounty for scope and rewards.
Customer best practices
You're a critical part of the security story. We recommend:
- Enable two-factor authentication on your account. Use a hardware key if you can.
- Don't collect data you don't need. Less data, less risk.
- Use the per-form webhook secret to verify incoming payloads on your side.
- Rotate API keys and webhook secrets if a team member with access leaves.
- Set per-form origin allow-lists for forms that should only be submitted from your domains.
Security questions, vulnerability reports, or compliance requests: hello@formbridge.ai
Changelog · v1.2, May 1, 2026 — added bug bounty program details. · v1.1, Apr 1, 2026 — region pinning and DR backup details.
