Security & data handling

Data flow

A submission arrives at your form endpoint over TLS, is scored for spam, and is written to our primary database before any other processing happens. Notification emails and webhooks are dispatched after the write, with automatic retries — a delivery failure can delay a notification but can never lose a submission.

Encryption

All traffic is TLS 1.2+ — form endpoints, dashboard, API, and the connection between the application and the database. Submission data lives in PostgreSQL on dedicated infrastructure in Nuremberg, Germany (Hetzner), on storage encrypted at rest with AES-256 full-volume encryption, and reachable only over authenticated TLS connections. Backups are encrypted with AES-256 before leaving the database server and stored in Helsinki, Finland, with continuous point-in-time recovery. Webhook payloads can be verified via HMAC-SHA256 signatures using your per-form secret.

What we store — and don't

We store the form fields you send us, plus the submitter's IP address and user agent (kept for rate limiting and abuse prevention). We do not write submission payloads to application logs, do not sell data, and do not use submission content for advertising or training.

Payment card details never touch our servers — checkout and billing run entirely on Stripe.

Retention & deletion

Every form can set a retention window; submissions older than it are purged automatically. Individual submissions can be deleted from the dashboard instantly, and deleting a form or workspace cascades to all of its data. Full-account deletion completes within 30 days of request.

Subprocessors

Hetzner Online GmbH (PostgreSQL hosting, Germany; encrypted backups, Finland), Vercel (application hosting, Frankfurt compute plus global edge), Postmark (transactional email), Stripe (billing), Cloudflare (Turnstile spam verification), Sentry (error monitoring, EU-hosted). Each processes only what its role requires. See the DPA for the current list, change log, and notice terms.

GDPR & Swiss FADP posture

For submission data, you (or your client) are the controller and FormDock is the processor. The dashboard gives you the tools to service access, export, and erasure requests directly. FormDock is operated from Switzerland. Since 15 September 2026, submission data is stored in the EU (database in Germany, backups in Finland) and the application runs in Frankfurt. Email delivery, billing, spam verification, and Vercel's edge network are provided by US companies under DPF/SCC transfer safeguards — we document this plainly so you can assess it.

Abuse & platform integrity

Per-form rate limits, layered spam filtering, and sending controls protect both your forms and our email reputation — which is what keeps notification deliverability high for everyone. Suspected relay abuse is suspended fast.

Reporting a vulnerability

Found something? Email security@formdock.app. We read every report, respond quickly, and credit responsible disclosure.