Security

Formkove takes security seriously. Every submission is encrypted in transit, infrastructure follows Cloudflare best practices, and we maintain strict access controls.

Encryption in Transit

All traffic between your forms, the Formkove API, and our backend is encrypted with TLS 1.3. Form submission endpoints enforce HTTPS-only — any HTTP request is rejected.

• TLS 1.3 minimum enforced across all endpoints
• HSTS (HTTP Strict Transport Security) with preload enabled
• Certificate transparency monitoring

Content Security Policy

Formkove enforces a strict Content Security Policy (CSP) on the dashboard and API surfaces:

• Script execution is restricted to trusted sources
• Inline scripts are disallowed except where explicitly needed
• Outbound form submissions use standard browser navigation or client-side fetch requests

When submitting forms to Formkove, no additional CSP changes are required for form submission to work.

SSRF Protection

Server-side request forgery (SSRF) is a common vector in form backends. Formkove protects against it by:

• Webhook URL validation — All target URLs are validated against known-bad patterns and private IP ranges
• Network-layer filtering — Outbound requests are restricted to public internet destinations only
• DNS rebinding protection — Webhook targets are resolved and validated at request time

Audit Logging

All access to form data and configuration changes are logged:

• Submission access — Every API call to read or export submissions is recorded
• Configuration changes — Form settings, integration keys, and tag changes are logged with a timestamp and actor
• Retention — Audit logs are retained for 90 days

Data Storage

Submission data is stored in encrypted format at rest. See the Privacy Policy for full details on data retention and deletion.

• Encryption at rest — All stored submissions are encrypted using AES-256
• Automatic deletion — Forms can be configured with auto-deletion policies
• GDPR tools — Export or delete all data for a specific respondent on request

Infrastructure Security

Formkove runs on Cloudflare Workers, inheriting Cloudflare’s security posture:

• DDoS protection — Cloudflare’s global network absorbs attacks before they reach us
• WAF — Managed web application firewall rules block common attack patterns
• Isolation — Each request runs in an isolated V8 isolate with no shared state
• D1 encryption — Database is encrypted at rest with automatic backup encryption

Compliance

Formkove is designed with GDPR compliance in mind. See the DPA for our data processing agreement.

For specific security questions or to report a vulnerability, contact security@formkove.com.