Security & Privacy

​

Security Features

​

Password Protection

1. Enable password protection in Form Settings
2. Set custom password
3. Users must enter password before viewing form
4. Wrong password = access denied

• Internal surveys
• Employee feedback forms
• Confidential applications
• Private event registrations
• Client-specific forms

Form Builder → Settings → Security → Password Protection
→ Toggle ON
→ Enter password
→ Save

• Minimum 6 characters
• No maximum length
• Case-sensitive
• Can include special characters

• Use strong passwords (mix of letters, numbers, symbols)
• Don’t share password publicly
• Change password periodically
• Use different passwords for different forms
• Share password securely (not in email subject)

​

reCAPTCHA v2 Protection

1. Enable reCAPTCHA in Form Settings
2. Users see “I’m not a robot” checkbox
3. Suspicious users get image challenge
4. Bots blocked automatically

Form Builder → Settings → Security → reCAPTCHA
→ Toggle ON
→ Save

• ✅ Public forms (high spam risk)
• ✅ Contact forms
• ✅ Registration forms
• ✅ Newsletter signups
• ❌ Internal/password-protected forms (not needed)
• ❌ Very short forms (may reduce conversions)

• May slightly reduce completion rate (1-3%)
• Protects from spam (worth the tradeoff)
• Legitimate users pass easily

​

Form Closing

Form Builder → Settings → Closing → Set Closing Date
→ Select date and time
→ Choose timezone
→ Save

• Form accessible until closing date
• After deadline: Shows “Form Closed” message
• New submissions blocked
• Existing submissions preserved

• Event registration deadlines
• Application periods
• Limited-time surveys
• Seasonal campaigns

​

Spam Protection

• Tracks device fingerprints
• Blocks repeated spam submissions
• Rate limits per device

• Default: 5 submissions per hour per device
• Configurable per form
• Prevents submission flooding
• Protects database from abuse

Form Settings → Advanced → Spam Protection
→ Max submissions per hour: 5
→ Time window: 60 minutes

• Device fingerprint (browser + system info)
• IP address (not stored long-term)
• Submission frequency
• Suspicious patterns

• No personal data in fingerprint
• Hashed for privacy
• Used only for spam detection
• Not shared with third parties

​

Data Privacy

​

Data Encryption

• All data encrypted with SSL/TLS
• HTTPS enforced on all pages
• API requests encrypted
• Webhook payloads encrypted

• Database encrypted at rest
• Backups encrypted
• File uploads encrypted
• API keys hashed

​

Data Storage

• Stored in secure database
• Encrypted at rest
• Regular backups
• Geo-redundant storage

• Stored in encrypted cloud storage
• Virus scanning
• Size limits enforced
• Temporary files cleaned up

• Submissions: Kept until you delete
• Logs: 30-90 days depending on plan
• Deleted data: Permanently removed within 30 days
• Backups: 90 days

​

GDPR Compliance

• Right to Access - Export your data anytime
• Right to Deletion - Delete data on request
• Right to Rectification - Update incorrect data
• Right to Portability - Download data in standard format
• Right to Object - Stop processing on request

1. Go to Account Settings → Privacy
2. Select action (export, delete, etc.)
3. Confirm request
4. Process completed within 30 days

• Only necessary data collected
• No unnecessary tracking
• No selling of data
• No third-party data sharing (except integrations you configure)
• Clear privacy policy

• Legal field type for consent
• Checkbox with custom text
• Required for submission
• Audit trail maintained

​

Data Access Control

• Owner has full access
• Admins have most access
• Members have limited access
• Configurable per workspace

• Organization-wide access model
• Workspace-specific access model
• Controlled by organization owner

• Password protection
• Custom domain isolation
• White labeling
• Access logs

​

Privacy Policy & Terms

• Add legal/statement field
• Link to privacy policy
• Link to terms of service
• Required checkbox for consent

Legal Field:
☑ I agree to the [Privacy Policy](https://company.com/privacy)
   and [Terms of Service](https://company.com/terms)

​

Security Best Practices

​

Account Security

• Use strong, unique passwords
• Enable password manager
• Don’t share account credentials
• Change password if compromised

• Use Google OAuth for easier login
• Revoke access if suspicious activity
• Review connected apps regularly
• Use work email (not personal)

• Sessions expire after inactivity
• Logout from all devices option
• Active sessions visible in settings

​

Form Security

• Enable reCAPTCHA on public forms
• Use password protection for sensitive forms
• Set form closing dates when appropriate
• Monitor submissions for spam patterns
• Use HTTPS custom domains
• Enable email verification

• Share form passwords publicly
• Disable reCAPTCHA on high-traffic forms
• Collect unnecessary personal data
• Use weak passwords
• Ignore spam submissions
• Share admin access freely

​

Data Handling

• Only collect necessary information
• Mark sensitive fields clearly
• Don’t collect SSN, credit cards, or passwords
• Use appropriate field types
• Add privacy disclaimers

• Review submissions regularly
• Delete old/unnecessary data
• Export important data for backup
• Clean up test submissions

• Use secure methods to share submissions
• Don’t email sensitive data unencrypted
• Use workspace permissions appropriately
• Revoke access when no longer needed

​

Integration Security

• Store securely (not in public repos)
• Rotate regularly
• Revoke if compromised
• Use separate keys per integration

• Verify webhook signatures
• Use HTTPS endpoints only
• Whitelist TopFormBuilder IPs
• Monitor webhook logs

• Use workspace accounts (not personal)
• Review permissions requested
• Revoke unused integrations
• Re-authorize if suspicious activity

​

Compliance Features

​

GDPR

• Data export (JSON, CSV)
• Right to deletion
• Consent management
• Data processing agreements
• Privacy by design
• Breach notification (within 72 hours)

• Legal/consent field type
• Checkbox for privacy policy acceptance
• Required field validation
• Audit trail of consents

​

CCPA (California Consumer Privacy Act)

• Do Not Sell option
• Data access requests
• Data deletion requests
• Opt-out mechanisms

​

Data Residency

• Data stored in secure data centers
• Backup locations disclosed
• Enterprise: Choose data region (optional)

• Standard contractual clauses
• Privacy Shield compliance (where applicable)
• GDPR-compliant data processing

​

Reporting Security Issues

​

Found a Vulnerability?

1. Email: [email protected]
2. Include:
   • Detailed description
   • Steps to reproduce
   • Potential impact
   • Your contact information
3. Do Not:
   • Exploit the vulnerability
   • Share publicly before fix
   • Access other users’ data

• Acknowledgment: Within 24 hours
• Investigation: Within 7 days
• Fix timeline: Depends on severity
• Public disclosure: After fix deployed

• Critical vulnerabilities: Recognition + bounty (case-by-case)
• Hall of Fame: Security researchers credited

​

Security Updates

• Email notifications for critical issues
• Changelog for security patches
• Status page for incidents
• Blog posts for major updates

• Critical patches: Immediate deployment
• High priority: Within 48 hours
• Medium priority: Within 2 weeks
• Low priority: Next release cycle

​

Security Checklist

​

For Form Owners

• Enable reCAPTCHA if public form
• Set password protection if needed
• Add privacy policy link
• Test submission process
• Configure notifications
• Review form permissions
• Check custom domain SSL

• Review submissions for spam
• Update passwords quarterly
• Check integration security
• Review workspace members
• Export data backups
• Delete old test forms
• Monitor activity logs

​

For Workspace Admins

• Configure strong password policy
• Enable SSO if available (Enterprise)
• Set up MFA (if available)
• Define workspace permissions
• Configure SMTP securely
• Set up integrations carefully

• Audit user access quarterly
• Review activity logs monthly
• Update API keys annually
• Monitor security alerts
• Train team on security practices
• Document security procedures

​

Certifications & Standards

• SOC 2 Type II (in progress)
• GDPR Compliant
• CCPA Compliant
• HTTPS/SSL Encrypted
• Data encryption at rest

• AWS/Cloud hosting
• DDoS protection
• Firewall protection
• Regular security audits
• Penetration testing (annual)

• Stripe for payments (PCI DSS compliant)
• Google reCAPTCHA
• Let’s Encrypt SSL certificates
• Cloudflare CDN

​

Incident Response

​

In Case of Breach

1. Detect - 24/7 monitoring
2. Contain - Immediate isolation
3. Investigate - Root cause analysis
4. Notify - Affected users within 72 hours
5. Remediate - Fix vulnerability
6. Review - Prevent recurrence

1. Change Password - Immediately
2. Review Activity - Check access logs
3. Revoke Sessions - Logout all devices
4. Update API Keys - If compromised
5. Monitor - Watch for suspicious activity
6. Contact Support - Report concerns

​

Status Page

https://status.topformbuilder.com

• Email notifications
• SMS alerts (critical only)
• RSS feed
• Slack integration

​

FAQs