How your form data is handled
Your visitors trust you with what they type. This page describes what actually protects it, and is deliberately silent about anything we do not hold.
Submissions travel over HTTPS, are stored before any email is attempted, are scoped to your workspace at the data layer, and are never rendered as markup anywhere in the product. Your form endpoint key is public by design, it sits in client-side HTML, so forms are protected by origin restriction and spam filtering rather than by treating a visible string as a secret.
What protects your data
Transport encryption
Every request to the submission endpoint and the dashboard is served over HTTPS. Plain-text HTTP submissions are refused rather than silently upgraded, so a misconfigured form fails loudly instead of leaking a payload once.
Submissions are never rendered as markup
Values that arrive from a visitor are displayed as plain text everywhere: the inbox, the notification email, and the export. Nothing submitted is ever interpreted as HTML or script, which removes the entire stored-XSS class from the product.
Workspace isolation
Every query that reads submissions is scoped to the owning workspace at the data layer, not filtered in the interface. A form ID from another account resolves to a not-found response rather than returning data.
Origin restriction
Each form can be limited to the domains you actually submit from. A request from anywhere else is rejected before it is stored, which is the main defence for an endpoint that is intentionally public.
Storage precedes delivery
A submission is written durably the moment it is accepted, before any notification is attempted. A mail outage, an unverified recipient, or an exhausted quota can delay an email; none of them can lose the payload.
Spam filtering with an audit trail
Filtered submissions go to a reviewable spam view for the retention window on your plan rather than being discarded. Every filter has false positives, and one you cannot audit will eventually eat a real enquiry.
If you have found a vulnerability, we want to hear about it before anyone else does.
security@maketheform.com- We acknowledge every report within one business day.
- We will not pursue legal action against good-faith research.
- We will credit you when the fix ships, if you would like us to.
- Please avoid privacy violations, data destruction, and service degradation while testing.
Frequently asked questions
→Is my form endpoint key a secret?
No, and it is not meant to be. The key goes into client-side HTML that anyone can view, so we treat it as an address rather than a credential. Protection comes from origin restriction, rate limiting, and spam filtering. Not from pretending a string in a public page is confidential.
→What happens to my submissions if I close my account?
Submissions are removed when the account is deleted. Export everything you need first, the dashboard provides a full export of stored payloads, and once deletion completes the data cannot be recovered.
→How long are submissions retained?
Retention depends on your plan. Once the window elapses a submission is permanently removed, including from the spam view, and cannot be restored by support.
→Can someone else submit to my form endpoint?
Technically yes, because the endpoint is public. That is true of every form backend. Restricting your form to the origins you actually post from means submissions from anywhere else are rejected before they are stored.
→How do I report a vulnerability?
Email security@maketheform.com with enough detail to reproduce the issue. We acknowledge within one business day and will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service degradation.
Questions we have not answered?
Security questionnaires, data processing questions, and anything a procurement team needs, ask directly.