# Request Forms security

Last updated 15 September 2026.

This page describes how Request Forms protects data in the live product at requestforms.io. It is a description of current practice. It is not a SOC 2 report, an ISO certificate, a HIPAA attestation, or a PCI attestation. We do not display those badges because we do not claim those certifications here.

Report a security issue to support@requestforms.io with security in the subject. We handle those reports first. Do not email passwords. Use the in-app reset flow if you lost access.

## Transport and browser protections

The public site is served over HTTPS. We send HSTS with a one-year max age, including subdomains, and we request preload. Session cookies use the Secure flag in production.

HTML pages send X-Frame-Options SAMEORIGIN and a frame-ancestors policy that blocks other sites from framing the app. Embed routes allow framing so you can place a form on your site. Invite links send a strict referrer policy.

## Accounts and sessions

Password accounts need at least 8 characters. We store a password hash. We do not store the raw password. Email must be verified before password sign-in. Google sign-in requires a verified Google email.

The website session is an HTTP-only cookie named rf_session. It lasts 7 days. Logout and password reset increment the session version and reject old tokens. The API does not accept that session cookie as a Bearer API key.

You can delete the account in Settings. Delete asks for your password. We can ban an account for abuse. A banned account can open /banned and little else.

## Access control

Organizations own forms. Owners and admins manage members, invites, API keys, Stripe Connect, and the paid plan. Roles limit who can change billing and keys.

API keys are Bearer tokens that start with rfk_. Owners and admins create and revoke them on the organization page. Calls are rate-limited per organization and per IP.

The hosted MCP server uses OAuth. We store hashed access and refresh tokens so we can revoke a grant. Sign-up and password tools are not exposed on hosted HTTP MCP.

## Form data

Workspace routes under /app need a signed-in session. Published form pages are public by design. Anyone with the link can view the form and submit. Treat the share link as public. Close the form by date or submission cap when you need that control.

Private workspace analytics, the response inbox, and form settings stay behind sign-in. CSV and Google Sheet export are owner actions in the workspace.

## File uploads

Uploads go through our API. The browser does not put files directly in storage. Secure upload is on by default. Those files use short-lived signed download links after we check access. Public uploads and public payment starts are rate-limited per form and IP.

Turn Secure upload off only when you need a public file URL, including in webhooks. You are responsible for files you make public.

## Payments

Plan billing uses Stripe Checkout. Form charges use Stripe Connect to the organization's Stripe account. Stripe processes card data. We do not store full card numbers. Connect and disconnect Stripe from the organization page.

## Embeds and custom domains

The embed script is a public file. Hosted embed pages allow framing. Your host page can inherit font and color into the form. Do not put secrets in embed attributes or in the public schema.

A paid custom domain serves your published forms on a hostname you verify. You must control that DNS. Search engines can index those forms. Keep unpublished work in the workspace.

## Webhooks and outbound data

Webhooks send submit payloads to the HTTPS URL you set. You can set a webhook secret. Use HTTPS only. Protect that endpoint. We rate-limit outbound webhook delivery.

Google Sheet export is a snapshot you create in Google. That copy follows Google's access rules, not our workspace roles.

## Abuse controls

Login, register, mail, public submits, views, captcha, public uploads, public payments, outbound webhooks, and API-key reads are rate-limited. Blocked calls return 429.

Forms can use a math captcha, a honeypot, and optional Google reCAPTCHA. We can suspend or ban accounts that attack the service or that collect abuse.

## Your responsibilities

Use a unique password. Revoke keys you no longer need. Review members. Treat published forms, embeds, and webhook URLs as sensitive. Do not collect data you cannot protect. See /privacy for how data is used and /terms for acceptable use.

## What this page does not claim

We do not claim SOC 2, ISO 27001, HIPAA, PCI DSS certification, or a formal penetration-test badge on this site. Stripe's own PCI scope covers card processing in Stripe products. This page will change when the product changes. The date at the top is the current version.

## Sitemap

- Home: https://requestforms.io/
- Website forms: https://requestforms.io/website-forms
- Pricing: https://requestforms.io/pricing
- Docs: https://requestforms.io/docs
- Blog: https://requestforms.io/blog
- Tools: https://requestforms.io/tools
- OpenAPI: https://requestforms.io/openapi.json
- llms.txt: https://requestforms.io/llms.txt
- XML sitemap: https://requestforms.io/sitemap.xml