How we keep your data safe.

• In transit: every connection to fantasticforms.com — public forms, the form-builder, our API, and embeds — uses TLS 1.2 or higher. HTTP requests are 301-redirected to HTTPS at the edge. HSTS is enforced.
• At rest: all submission data, form definitions, account data, and uploaded files are stored encrypted at rest using AES-256 by our infrastructure provider (Supabase, which uses AWS RDS + S3 with KMS-managed keys).
• Secrets: API keys, OAuth tokens, and Stripe webhook secrets are stored encrypted and surfaced to the application only at runtime. Never logged.

Fantastic Forms never touches your customers' card data. Every payment element in your forms redirects buyers to a hosted checkout page run by the payment provider you chose:

• • Stripe — PCI DSS Level 1 service provider (annually audited by a QSA)
• • PayPal — PCI DSS Level 1
• • Paddle, Polar, Lemon Squeezy, Dodo, Creem, Whop — each handles checkout and card data on their own PCI-certified infrastructure

Our backend only receives a redacted session_id /payment_intent_id from the provider after a transaction completes. Card numbers, CVVs, and expiry dates never reach our servers, database, or logs. This puts Fantastic Forms in PCI DSS SAQ A scope — the simplest tier — and we self-attest annually.

• Passwords are hashed with bcrypt (12 rounds). The plaintext is never written to disk.
• Sessions use signed JWTs with a rotating secret; tokens expire after 7 days of inactivity.
• Two-factor authentication (TOTP) is available for every account from Settings → Security. Backup codes are issued for recovery.
• Admin access to our production database, infrastructure provider, and Stripe dashboard is restricted to the founding team and protected with 2FA. We use principle of least privilege for engineering access.
• Audit logs capture every state-changing action (logins, form CRUD, member-role changes, API key creates/revokes, 2FA toggles) with 90-day retention. Pro-plan workspace owners can export their full audit trail to CSV from /team at any time; platform admins have cross-workspace visibility for incident response.

Fantastic Forms runs on a small, security-vetted stack of sub-processors. Each one is named, scoped, and has its own audited compliance posture:

We do not sell, share, or transmit your data to any party not on this list. We will update this list before adding a new sub-processor.

We operate the controls that match the certifications below. Where we rely on a certified sub-processor, we are honest about that — we don't claim the certification as our own.

• PCI DSS — compliant via SAQ A. Card data is handled exclusively by Stripe (PCI DSS Level 1) and other certified payment providers; no card data ever reaches our infrastructure.
• SOC 2 Type II — our infrastructure provider (Supabase) is SOC 2 Type II certified. Stripe is SOC 1 Type II + SOC 2 Type I/II certified. We do not currently hold our own SOC 2 attestation.
• ISO 27001 — our infrastructure provider (Supabase) and payments provider (Stripe) are both ISO 27001 certified. Fantastic Forms operates with controls aligned to ISO 27001; we do not currently hold our own ISO 27001 certificate.
• GDPR / UK-GDPR — we honor data subject rights (access, deletion, export). Contact us for any DSAR.
• CCPA — California residents can request access, deletion, or opt-out of “sale” of personal data (we don't sell personal data).
• NIST Cybersecurity Framework — self-mapped against the five CSF functions (Identify, Protect, Detect, Respond, Recover). Controls include continuous monitoring via Sentry, quarterly access reviews, encrypted backups, and a documented incident response playbook. Request our mapping.
• CIS Controls v8 — self-attested. We operate against the CIS Critical Security Controls covering inventory management, secure configuration, access control, malware defenses, data recovery, and audit-log management. Full mapping available on request.
• ESIGN Act & UETA — every form signature captured through our Signature element is stored with an audit trail (respondent IP, user agent, timestamp, form version) that satisfies the intent-to-sign and record-retention requirements of both the federal ESIGN Act and the state-level Uniform Electronic Transactions Act.
• US Export Administration Regulations (EAR) — Fantastic Forms is a general-purpose SaaS not subject to EAR licensing. Our payment processor (Stripe) programmatically blocks transactions from OFAC-sanctioned countries. Customers are contractually prohibited from using the service to transfer controlled technology to sanctioned parties.
• Student Privacy Pledge — we adhere to the twelve commitments of the Student Privacy Pledge (studentprivacypledge.org): no selling of student data, no behavioural targeting to students, full data ownership by the school, security safeguards, and deletion on request.

• Form submissions are retained for as long as the owning account is active, or until the form owner deletes them — whichever comes first.
• Deleting a form permanently removes its submissions from our primary database within 24 hours. Encrypted backups are purged on a rolling 30-day cycle.
• Closing your account deletes all your forms, submissions, integrations, and billing data. Stripe-side records are retained per Stripe's policy for legal/tax purposes.

• Production errors are captured in real time via Sentry; on-call engineers are paged for severity-1 incidents.
• If a security incident materially affects your data, we will notify affected customers within 72 hours of confirmation, in line with GDPR Article 33.
• We test backups quarterly. RPO target: 1 hour. RTO target: 4 hours.

If you believe you've found a security issue, please contact us with steps to reproduce. We commit to acknowledging your report within 2 business days and to keeping you in the loop while we triage. We do not currently run a paid bug bounty but we publicly credit researchers (with permission) once a fix has shipped.

Please do not run automated scanners against our production infrastructure or attempt to exfiltrate other users' data. Stick to non-destructive testing on accounts you own.