Security
What we actually do and do not do
This page is written to be checkable. Everything in the first half is implemented in the product today. The second half lists, by name, the certifications and guarantees we do not hold — because the useful version of this page is the one you can rely on during procurement.
Implemented
Measures that are in place
Engineering controls that exist in the running system, not intentions.
Authentication
Passwords hashed with a memory-hard algorithm, optional TOTP two-factor with single-use recovery codes, and rate limiting on sign-in, two-factor and password reset that is shared across servers rather than per-process.
Sessions
A session lasts one day, fixed at sign-in, and nothing extends it in the background. When it ends you are signed out — in the tab you are sitting in, not just on the next request.
Authorization
Every request is checked server-side for organization membership and role. The interface hides what you cannot do as a courtesy; the API is what actually refuses it.
Tenant isolation
Data is scoped to one organization at every layer — forms, responses, files, option lists and exports. A member of one workspace cannot reach another’s records by changing an identifier.
Secrets and uploads
Webhook secrets and two-factor seeds are encrypted at rest with AES-256-GCM and are never returned by the API once set. Uploads are type- and extension-allowlisted, size capped at the storage layer, and re-verified against the stored object.
Outbound requests
Webhooks are HTTPS-only, with the destination resolved and checked at delivery time so it cannot point at a loopback, private or cloud-metadata address. Redirects are not followed and responses are truncated.
Submission validation
Every submission is re-validated on the server against the published version — required fields, types, option membership, bounds and payload size — so a crafted request cannot write data the form does not permit.
Audit log
Administrative actions are recorded with the actor, the resource and the detail: publishing, settings changes, membership changes and exports.
Accessibility
Labels tied to their controls, error states announced to screen readers rather than shown only in red, grouped inputs in a real fieldset, and keyboard operability throughout. Built in, not independently audited — see below.
Not held
What we do not have
Named explicitly. If a control you need is on this list, we are not the right choice for that workload yet, and we would rather you found out here than in an incident.
- SOC 2 (Type I or Type II)
- We have not been audited and hold no report. Do not list us as a SOC 2 vendor.
- HIPAA / BAA
- We do not sign Business Associate Agreements and are not a HIPAA-compliant processor. Do not put protected health information into Formora.
- ISO 27001
- No certification, and no audit in progress.
- PCI DSS
- We never handle cardholder data. Do not build a form that collects card numbers — the platform is not designed to receive them.
- Data residency
- You cannot currently choose the region your data is stored in. Ask us where it is and we will tell you.
- Independent accessibility audit
- The interface is built to be operable by keyboard and screen reader, but no third party has certified it against WCAG.
Your data
What you can do without asking us
We do not sell your data, mine it for our own analytics, or use responses to train any model. What we process, we process to run the service you are using it for. If you need a Data Processing Agreement, ask us and we will tell you honestly what we can and cannot sign today.
Found a vulnerability?
Tell us before you tell anyone else, and we will work the fix with you.
Write to security@formora.app with the steps to reproduce, what you were able to access, and how you found it. We will acknowledge within two working days and keep you updated until it is closed.
Please do not run automated scanners against production, access data belonging to anyone else, or degrade the service for other users while testing. Give us a reasonable window to ship a fix before publishing.
Questions we have not answered here?
Security questionnaires, architecture questions, or where exactly your data sits — ask, and you will get a straight answer.