What we do with your data, and what we do not
Controls
- Tenant isolation is enforced by the database. Every table carries an account id and row-level security policies; the dashboard connects as the signed-in user, so a query can only ever return that account's rows. It is tested by asserting that access is denied, not that a policy exists.
- Channel credentials are encrypted at rest with a key held outside the database, and are redacted in every log line and API response.
- IP addresses are never stored. We keep a salted, truncated hash with a daily-rotating salt, plus a country code.
- Retention is enforced by the database, not by a job someone remembers to run: every submission gets an expiry when it is written.
- Submission content is never rendered as HTML, interpolated into a query, or executed. A strict Content-Security-Policy with no
unsafe-inlinebacks that up. - Deleting an account really deletes it. Not a flag — the rows are gone.
More detail on the security page.
Subprocessors
We give 30 days' notice before adding or replacing one. EU regions wherever they are offered.
| Name | Purpose | Location |
|---|---|---|
| Cloudflare | Edge ingest, WAF, queueing | Global |
| Supabase (AWS) | Database, auth, storage | EU (eu-central-1) |
| Vercel | Dashboard and docs hosting | EU region |
| Paddle | Payments, merchant of record | EU/UK |
| Sentry | Error monitoring | EU region |
Customer-directed recipients — these receive data only because you connected them:
- Discord, Slack, Telegram — Delivery, only where the customer connects them
Documents
- Privacy policy
- Data processing agreement
- Terms of service
- security.txt — how to report a vulnerability
What we do not claim
Being straight about the gaps is worth more than a badge. Right now:
- No SOC 2 We have no SOC 2 or ISO 27001 certification, and no audit in progress. If your procurement requires one, we are not a fit yet.
- No contractual SLA We do not offer an uptime guarantee with financial remedies.
- Small team Formwire is run by a very small operation. That is why the controls above are enforced by the database and by tests rather than by process — there is nobody to remember them.