Trust
Security at Formblyt
Security is built into every layer of Formblyt — from encrypted credentials and row-level database policies to signed webhooks and least-privilege infrastructure.
Effective June 13, 2026 · Last updated June 13, 2026
1. Data encryption
All traffic to Formblyt is encrypted in transit using TLS 1.2 or higher. Data at rest — including form responses, uploaded files, and user records — is encrypted on managed storage. Sensitive third-party credentials, such as payment gateway API keys, are additionally encrypted at the application layer using AES-GCM before being written to the database.
2. Authentication and access control
Authentication is handled through a managed identity provider with secure password hashing, session tokens, and support for OAuth logins. Every database table protecting user data enforces row-level security policies scoped to the authenticated user — data cannot be read across accounts, even by a compromised session.
3. Payments and webhooks
Formblyt never stores raw card data. Checkout is handled by the connected gateway (Razorpay, Stripe, Cashfree, or PayPal) and payment status is only trusted after signed webhook verification. Webhook signatures are validated with HMAC and timing-safe comparisons before any submission is marked as paid.
4. Infrastructure
Formblyt runs on managed edge and cloud providers with SOC 2 controls, isolated environments, and regular patching. Secrets and service keys are stored in a secure secret manager and never exposed to browser code. Backups run on an automated schedule with point-in-time recovery.
5. Monitoring and logging
We maintain application and gateway activity logs, error monitoring, and per-user audit trails for payment gateway connections. Anomalies are surfaced to on-call engineers, and privileged operations are limited to a small set of maintainers.
6. Responsible disclosure
If you believe you have found a security vulnerability, please report it to security@formblyt.com. We appreciate coordinated disclosure and will acknowledge valid reports promptly. Please do not perform testing that could impact other users, degrade the service, or access data that is not yours.
7. Compliance
Formblyt is built to support GDPR obligations for EU and UK users. See our GDPR notice and Privacy Policy for details on lawful basis, data subject rights, and international transfers.