Security

Security is one of our biggest priorities. Learn how we keep your data secure with our security practices.

Privacy Friendly
Built with privacy in mind with no third-party cookies, fingerprinting, or invasive tracking.

Open Source
Formo SDKs are open source. We believe in transparency and community contributions.

SOC 2 (in progress)

We securely manage your data. Our SOC 2 compliance report will be available on request.

NPM Trusted Publishing

Eliminates security risks from long-lived write tokens, which can be compromised.

Subresource Integrity

Formo supports SRI, which helps prevent attacks like cross-site scripting (XSS) and NPM hijacking.

Content Security Policy

Formo supports CSP, which helps prevent attacks like cross-site scripting (XSS) and data injection.

Encryption in transit

Formo secures all connections with industry-standard TLS 1.2+ encryption.

Encryption at rest

All data volumes, including backups, are encrypted at rest with industry-standard AES-256 keys.

Monitoring

Live 24/7 on-call rotations with internal escalations monitor across all systems.

Backups

All customer databases are continuously backed up to highly durable storage.

Data center security

We run on Amazon Web Services (AWS), which have the highest levels of security & reliability.

Security reviews

Engineering teams review for security best practices to address potential threats before deployments.

Vulnerability management

Formo conducts regular penetration tests in addition to internal security reviews.

Quality assurance

Automated tests, code reviews, and security reviews run after each code change as part of QA.

Multi-Factor Authentication

MFA adds an additional layer of security to user accounts and workspaces.

Role Based Access Control

RBAC enforces the least privilege principle on users based on specific roles (i.e. Admin, Editor, Member.).

Payments and PCI

Formo uses Paddle to process payments and does not store credit card information.

Security training

Security awareness training ensures all employees are knowledgeable of security best practices.

Physical security

Physical and environmental controls in place to ensure that our data centers are secure and reliable.

Incident response

We have a structured process and on-call that responds to security incidents.

Subprocessors

Formo keeps the list of data subprocessors updated in Data Processing Addendum (DPA.)

Changelog

Formo keeps a public changelog where a summary of updates and fixes are published each week.

Questions?

If you have any questions regarding our security practices, please contact support.