# Security

Security is one of our biggest priorities. Learn how we keep your data secure with our security practices.

**Privacy Friendly**  
Built with privacy in mind with no third-party cookies, fingerprinting, or invasive tracking.

**Open Source**  
Formo SDKs are open source. We believe in transparency and community contributions.

### SOC 2 (in progress)
We securely manage your data. Our SOC 2 compliance report will be available on request.

### NPM Trusted Publishing
Eliminates security risks from long-lived write tokens, which can be compromised.

### Subresource Integrity
Formo supports SRI, which helps prevent attacks like cross-site scripting (XSS) and NPM hijacking.

### Content Security Policy
Formo supports CSP, which helps prevent attacks like cross-site scripting (XSS) and data injection.

### Encryption in transit
Formo secures all connections with industry-standard TLS 1.2+ encryption.

### Encryption at rest
All data volumes, including backups, are encrypted at rest with industry-standard AES-256 keys.

### Monitoring
Live 24/7 on-call rotations with internal escalations monitor across all systems.

### Backups
All customer databases are continuously backed up to highly durable storage.

### Data center security
We run on Amazon Web Services (AWS), which have the highest levels of security & reliability.

### Security reviews
Engineering teams review for security best practices to address potential threats before deployments.

### Vulnerability management
Formo conducts regular penetration tests in addition to internal security reviews.

### Quality assurance
Automated tests, code reviews, and security reviews run after each code change as part of QA.

### Multi-Factor Authentication
MFA adds an additional layer of security to user accounts and workspaces.

### Role Based Access Control
RBAC enforces the least privilege principle on users based on specific roles (i.e. Admin, Editor, Member.).

### Payments and PCI
Formo uses Paddle to process payments and does not store credit card information.

### Security training
Security awareness training ensures all employees are knowledgeable of security best practices.

### Physical security
Physical and environmental controls in place to ensure that our data centers are secure and reliable.

### Incident response
We have a structured process and on-call that responds to security incidents.

### Subprocessors
Formo keeps the list of data subprocessors updated in Data Processing Addendum (DPA.)

### Changelog
Formo keeps a public changelog where a summary of updates and fixes are published each week.

### Questions?
If you have any questions regarding our security practices, please contact support.