Home / Features / Form Security

Security by default

Serious security, on every form you publish

Encrypted uploads, malware scanning, bot protection, and team-level access control — built into the platform, not sold as add-ons. Your respondents' data is protected before you think about it.

Try It Free See What's Inside

AES-256 encryption · Malware scanning · Bot protection · Audit log

Incoming file — resume.pdf

File type & size validated

MIME + magic bytes checked

Malware scan passed

Scanned with ClamAV

Encrypted at rest

AES-256 envelope, per-file key

Stored & attached to response

Visible only to your workspace

Your respondents' data, protected

Everything submitted through your forms goes through a hardened pipeline before it's stored.

AES-256 envelope encryption

Every uploaded file is encrypted at rest with AES-256 using a unique per-file key — signatures, documents, images, all of it.

Malware scanning on every upload

Files are scanned with ClamAV before storage, with MIME-type and magic-byte validation and strict extension allowlists on top.

Tamper-proof payment totals

On payment forms, totals are recalculated server-side from your price list — editing the page can't change what gets charged.

Bots and abuse, filtered out

Spam protection at the field level, the platform level, and the human level.

CAPTCHA field

Add a CAPTCHA (Google reCAPTCHA v2) to any form to challenge automated submissions before they reach your inbox.

Platform-level bot defense

Cloudflare Turnstile protects sign-up and login, while public form endpoints run browser checks and rate limiting.

Built-in abuse reporting

Every published form carries an anti-phishing notice and a report option, so misuse gets flagged and reviewed fast.

Your account, locked down

The account that owns the data deserves the same protection as the data itself.

Two-factor authentication

Add a second factor to your login. New sign-ups and sign-ins are verified with email one-time codes.

Active session control

See every device signed into your account and revoke any session — or all of them — with one click.

Login history

A visible trail of recent sign-ins, so anything unfamiliar stands out immediately.

Email verification

One-time codes at signup keep throwaway and mistyped addresses out of your workspace.

Active sessions

MacBook Pro · ChromeBerlin, DE · now Current

iPhone · SafariBerlin, DE · 2h ago Revoke

Windows · EdgeMadrid, ES · 3d ago Revoke

Revoke all other sessions →

Team access, precisely scoped

Five roles and seventeen granular permissions decide exactly who can see, edit, export, and administer.

Role-based permissions

From owner to view-only: 5 roles built on 17 granular permissions covering forms, submissions, billing, and members.

Permission-gated exports

Data leaves your workspace only through members explicitly allowed to export it.

Full audit log

Form edits, member changes, billing actions, settings — every significant action is recorded with actor and time.

Explore the Audit Log →

Integrations that don't leak

HMAC-signed webhooks

Webhook payloads are signed with HMAC-SHA256 secrets you can rotate with a grace period — receivers can verify every delivery is really from us.

Encrypted integration tokens

OAuth tokens for connected services are stored encrypted at rest, never in plain text.

Frequently asked questions

Are file uploads encrypted?

Yes. Every file uploaded through a form is encrypted at rest with AES-256 envelope encryption using a unique per-file key, after passing size, MIME-type, and magic-byte validation and a ClamAV malware scan.

How does FormBuilder stop spam submissions?

In layers: you can add a CAPTCHA field (Google reCAPTCHA v2) to any form, public form endpoints enforce browser checks and rate limiting, and Cloudflare Turnstile protects account sign-up and login.

What happens if someone misuses a form built on FormBuilder?

Every published form displays an anti-phishing notice and a report option. Reports are reviewed by our team, and confirmed abuse leads to immediate takedown and account suspension.

Can I control what my team members can access?

Yes. Workspaces use 5 roles built on 17 granular permissions — covering viewing, editing, exporting, billing, and member management — and every significant action is recorded in the audit log.

Does FormBuilder sell or share my data?

Never. We don't sell, rent, or share your data with third parties for advertising. Your form data belongs to you — export it or delete it at any time.

How are webhooks secured?

Webhook payloads are signed with an HMAC-SHA256 secret so your receiving server can verify authenticity. Secrets can be regenerated with a grace period, and deliveries are retried with backoff and logged.

Looking for the bigger picture — data ownership, retention, and anti-abuse policy? Read our Security & Data Protection overview →

Collect data like it matters

Every plan ships with the same security foundation — encryption, scanning, bot protection, and access control from day one.

Start Building Free