Security

Hosting

FormVault runs in Docker containers on servers from Hetzner in Germany. A reverse proxy terminates HTTPS in front of the application; the web app and API are served behind it, with the database on the same host. Uploaded files are stored in Hetzner Object Storage. The other services that handle data are listed on the subprocessors page.

Sign-in and access control

• Sign-in uses FjordID, our self-hosted Keycloak, over OpenID Connect with PKCE (S256). FormVault never sees or stores your password.
• Every API request to a protected route carries a JWT. The API verifies its signature against FjordID's published keys and checks the issuer and the client it was issued to.
• Data is scoped to an organisation. Each form, submission and API key belongs to one, and access is checked on every request. Members have one of three roles: owner, editor or viewer.
• Public form pages and submissions need no sign-in. They are rate limited, and submissions pass a spam filter.

How submissions are protected

• Answers are encrypted with AES-256-GCM, with a fresh random IV for each submission, before they are written to the database. The key comes from the server's configuration and is not stored in the database, so a copy of the database alone does not expose answers.
• The server decrypts answers when an authorised user views or exports them, or asks for an AI summary. This protects stored data and backups; it does not hide answers from FormVault's own systems.
• Files uploaded to a file field are stored in object storage under a randomly named key. They are not encrypted by the application, and server-side encryption is not enabled on the bucket. Downloads use presigned links that expire after one hour.
• Each submission is stored with the respondent's IP address and browser user agent. Submit, view, export and delete actions are written to an audit log.
• Form owners can set a retention period in days. A daily job deletes submissions older than that.

Certifications

FormVault does not currently hold or claim any security certification or independent audit report.

Reporting a security issue

If you think you have found a vulnerability, email support@formvault.eu with what you found and how to reproduce it. Please do not access other people's data or disrupt the service while testing, and give us reasonable time to fix the issue before sharing it publicly. We have no bug bounty.