This page describes how FormWork hosts and protects data and the current product controls. It helps you assess an implementation. Our contractual commitments are in the terms of service and their data processing terms.
Where your data is hosted
The FormWork application, its database and uploaded and generated files are hosted with DigitalOcean in its London data centre, in the United Kingdom. PDF documents are generated there too.
A small number of other providers handle specific tasks, such as Stripe for billing, Twilio SendGrid for email, Cloudflare for CAPTCHA checks and Sentry for error monitoring. Some of them process data outside the UK under recognised transfer safeguards. The privacy policy lists every sub-processor and what it receives, and we update that list at least 14 days before a new sub-processor starts processing customer data.
How data is protected
- All traffic between browsers, API clients and FormWork is encrypted in transit with HTTPS.
- Passwords and API key secrets are stored only as one-way hashes. Approval, status, invitation and password reset links are stored only as hashes too.
- Secrets you store for integrations and extensions, such as API tokens, are encrypted.
- Sign-in uses secure, HTTP-only session cookies that expire after 7 days.
- Sign-up, sign-in, password reset and forms that use it are protected by Cloudflare Turnstile CAPTCHA checks, and sensitive actions are rate limited.
- Requests the service makes to other systems, such as HTTP request steps and webhooks, are blocked from reaching private networks.
- Error reports have sign-in cookies, authorisation headers and private link tokens removed before they are sent to our error monitoring provider.
- Access to customer accounts is limited to a small number of authorised staff, who use it to support customers and run the service. Their access is logged.
Retention, backups and deletion
You decide what to collect and when to delete entries. FormWork keeps backups for 30 days, so deleted data is erased from backups within 30 days. When a customer’s agreement ends, customer data is deleted within 90 days unless the law requires us to keep it. Finished automation runs are cleaned up after 90 days and email job records after 30 days. Server logs and error monitoring data are kept for 90 days. The privacy policy has the full schedule.
Contracts and data protection
FormWork is operated by FORMWORK SOFTWARE LIMITED, a company registered in England and Wales and registered with the Information Commissioner’s Office under number ZB781751. For data your forms collect, you are the controller and we are your processor. Our data processing terms cover processing instructions, confidentiality, security, sub-processors, international transfers, breach notification, assistance with data subject requests, deletion and audits. They form part of the terms of service, so every customer has them without signing a separate document.
If we become aware of a personal data breach affecting your data, we will tell you without undue delay.
Accounts are the access boundary
Projects organise resources within an account. They don’t provide project-specific member permissions: everyone in the account can open every project, form and entry.
There are two roles, Admin and Member. Members build forms, change processes and automations, publish, and work with entries. Admins can also invite and remove people, manage groups, create and revoke API keys, manage billing, delete forms and data tables, and override the process, for example by moving an entry to any stage. Member is not a read-only role, and groups decide who owns and approves work, not who can see it. Use separate accounts when clients or teams must not see or edit one another’s resources. See team members and roles.
Team fields are hidden from respondents, not from your team. They are not a way to restrict what team members can see.
Server-to-server API access
Only admins can create API keys. A key belongs to one account and acts as the person who created it; if that person is removed from the account, the key stops working. A key can have full access or chosen permissions and projects, including read-only access. Existing full-access keys retain their access. Requests send the account ID in a header, and it must match the key’s account.
The complete key is shown once, and FormWork keeps only a hash of its secret. Keep it in a protected server-side secret store, give each integration its own named key, and revoke retired keys. Never put an account API key into an embedded form or public browser code.
Respondent entry endpoints use a separate entry access key in X-Formwork-Entry-Key. Treat that key as access to the respondent’s entry and follow the endpoint requirements in the API reference.
AI assistant access
AI assistants connect through MCP, using your FormWork login or an API key. A login connection can cover chosen accounts and projects. It acts within your role, granted permissions and each account’s AI setting.
Account admins can allow assistant work, prevent publishing, make access read only or turn it off, and remove their account from a connection. The AI setting applies to MCP calls, including calls made with a full-access API key; it doesn’t change ordinary REST API access.
Publishing checks the reviewed draft revision. Bulk entry changes need a confirmed dry run first. The assistant is instructed to ask before publishing or deciding approvals; the client controls its tool-call approval interface.
Password answers, signatures, secret values, file download URLs and private approval and status links are withheld from MCP results. Other allowed setup and entry data goes to the assistant’s provider when requested. See Permissions and controls and the privacy policy.
Links for people outside your team
Two kinds of link give people without a FormWork account limited access to one entry.
Approval links. An approval stage can email approvers a link to approve or reject an entry. Each link is for one person and one entry, works once, and expires after the number of days set on the stage. Opening the link doesn’t record a decision; the approver confirms on the page. FormWork stores only a hash of each link, the page isn’t indexed by search engines, and repeated attempts are slowed down. A forwarded email forwards the link, so whoever has it can decide. Approvers see only the answers you choose to show. See approvals.
Respondent status links. If you turn on respondent status, the person who submitted an entry can follow its progress on a read-only page. It shows the label you choose for each stage, not your stage names, owners, comments or answers. Anyone with the link can see the page, and you can turn a link off from the entry. It is off by default. See respondent status.
Rules and history
Form logic and validation run on the server. This keeps the configured processing rules in the form engine, but it does not replace testing, access management or careful integration design.
Form versions keep the questions each entry was answered with. Each entry’s history records answer corrections, team field changes, stage moves, approvals and automation runs, with who made each change. The account audit log separately records key and AI connection events, assistant writes and form publications; account admins can read it through the REST API. It does not record every read or ordinary app edit, and these histories are not an independently certified or immutable compliance audit log.
Sign-in and operational responsibilities
People sign in with an email address and password. Changing a password needs the current password and logs the person out everywhere. Each person can log out their other devices from their profile. Admins can’t end another person’s sessions individually; removing someone from the account ends their access to it. Review account membership and API keys when access requirements change.
You choose what information to collect, who belongs to an account, who approves entries, and where automations and API connectors send information. Test failure handling in other systems and review the data you send to them.
Certifications
FormWork does not currently hold an independent security certification such as SOC 2 or ISO 27001, and the controls on this page have not been independently audited. Our hosting provider, DigitalOcean, maintains its own certifications for its data centres.
Reporting a security issue
If you think you have found a security vulnerability in FormWork, email hello@useformwork.com with the details and steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and don’t access, change or delete data that isn’t yours while testing.
Assessing specific requirements
For security questionnaires or requirements this page doesn’t answer, email hello@useformwork.com or contact the FormWork team.