Security
Formkove runs on Cloudflare Workers and is built with defense in depth: every layer assumes the one before it can fail.
Encryption
Section titled “Encryption”- In transit: All traffic to
app.formkove.comuses HTTPS. The app sendsStrict-Transport-Security(HSTS) so browsers never fall back to plain HTTP. - At rest: Submissions and account data live in Cloudflare D1, which encrypts data at rest.
- Secrets: Turnstile secret keys, webhook signing secrets, and Slack/Discord/Google Sheets URLs are additionally encrypted by Formkove (AES-256-GCM) before they’re stored. They are never shown again after you save them.
Form IDs and API Keys
Section titled “Form IDs and API Keys”- Signed form IDs: Form IDs carry a cryptographic signature. Forged or guessed IDs are rejected before touching the database.
- Public-safe: A form ID can only send submissions to its form. It can’t read data or access your account.
- API keys are signed, stored only as hashes, scoped to a single form, and revocable at any time.
Abuse and Spam Protection
Section titled “Abuse and Spam Protection”- Rate limits per IP and form (10 per minute, 30 per hour), plus edge firewall rules
- Request limits: 100 KB per submission, 100 fields, 10 KB per field
- Honeypot fields and Cloudflare Turnstile with your own keys, on every plan
- AI spam quarantine on every plan
- Allowed Origins: browsers only accept responses for sites you’ve listed (see Allowed Origins)
- Abuse review: forms used for phishing or credential collection are disabled. Report abuse to [email protected].
Account Security
Section titled “Account Security”- Email verification on signup, and a security email on new sign-ins
- Rate-limited sign-in, signup and password reset, protected by Turnstile
- Sensitive actions (account deletion, ownership transfer) require your current password
- View and revoke active sessions from Account settings
- Role-based access in team workspaces: only owners and admins can change form settings, integrations or export data
Webhooks and SSRF Protection
Section titled “Webhooks and SSRF Protection”- Webhook and integration URLs must be public internet addresses. Private/internal IP ranges,
localhost, and Formkove’s own hosts are rejected when you save the URL and again on every delivery. - Deliveries are signed with HMAC-SHA256 including a timestamp, so you can reject forged or replayed requests.
Content Security Policy
Section titled “Content Security Policy”The dashboard is served with a nonce-based Content Security Policy, X-Content-Type-Options: nosniff, a strict Referrer-Policy, and a restrictive Permissions-Policy. You don’t need to change your own site’s CSP to submit forms to Formkove, beyond allowing connect-src https://app.formkove.com if you submit with fetch().
Email Deliverability
Section titled “Email Deliverability”Notification emails are sent through AWS SES with DKIM, SPF and DMARC. Bounced or complaining addresses are suppressed automatically, and every notification includes a one-click unsubscribe link.
Audit Logging
Section titled “Audit Logging”Security-relevant events are recorded in an internal audit log: sign-ins and failed sign-ins, password resets, form creation/rename/deletion, API key changes, billing changes, team membership changes, and administrative actions.
Your Data
Section titled “Your Data”- Submissions are kept until you delete them, delete the form, or delete your account.
- Export everything, or delete your account, yourself from Account settings.
- See the Privacy Policy and DPA for details.
Reporting a Vulnerability
Section titled “Reporting a Vulnerability”Email [email protected]. Please include steps to reproduce. We’ll acknowledge your report and keep you updated while we fix it.