Your respondents’ data, handled properly
Understand the controls in the product, the information your forms collect and the responsibilities that come with using them.
- Workspace access checks
- Form access controls
- Provider transparency
- Privacy requests
How it is protected
Data protection
The service processes answers, uploads and submission metadata to operate your forms. Storage and retention depend on the deployed systems and your instructions; review the privacy notice before collecting personal data.
Access control
Authenticated account access and workspace/form permission checks protect management actions. Review invitations and connected-service permissions, and revoke access when it is no longer needed.
Infrastructure
The marketing site uses Cloudflare. The application backend uses MongoDB and R2 storage. The marketing site's APAC placement does not establish a residency guarantee for the whole service.
Privacy by default
You control what your forms ask and which integrations receive answers. AI requests send selected input and context to a configured provider. Check the privacy notice and provider register before enabling these features.
What we actually do
The practices behind the claims above, stated plainly.
- Account authentication and workspace/form access checks
- Form password and email-verification controls where configured
- Server-owned records to validate respondent uploads
- Expiring signed upload requests and cleanup for unfinished uploads
- Authorisation checks for billing and integration changes
- Separate privacy guidance for accounts and form respondents
Compliance and documentation
Review the legal documents and confirm the production controls required for your use case. We do not claim an independent certification or audit report on this page.
Privacy responsibilities
Identify the controller, lawful basis, notices and safeguards required for your respondents and your location.
Data processing agreement
Review the proposed DPA and complete its processing, security and transfer schedules before relying on it.
Sub-processors
The provider register identifies known services and the production details still awaiting confirmation.
Security review
Contact us about the evidence and controls your organisation needs. Availability must be confirmed for the actual deployment.
Need something for your security review?
Send us the questionnaire and we will turn it around.