Security

Infrastructure

• All traffic served over TLS 1.2 or higher; HTTP is redirected
• Data encrypted at rest by our database and storage providers
• Hosted on Vercel and Neon, both of which maintain SOC 2 Type II attestations
• Automated database backups with point-in-time recovery

Application

• Passwords hashed with a memory-hard algorithm; we cannot read or recover them
• Email verification required before a password account can sign in, so nobody can claim an address they don’t control
• Role-based access control on every workspace, enforced server-side — hiding a button is never our access control
• Rate limiting on authentication and form submission endpoints
• Optional Cloudflare Turnstile and an always-on honeypot on public forms
• OAuth tokens for integrations stored encrypted, requested at the narrowest scope that works

Access control

• Production access limited to those who need it
• Multi-factor authentication required on all internal accounts
• Support staff cannot read your form responses as part of routine work
• Administrative impersonation is read-only by default, always visibly flagged in the interface, and always written to an audit log

What we don’t claim

We would rather be straight with you than impressive:

• We are not a PCI-DSS environment. Don’t collect card numbers in a form field. Card payments are handled entirely by Dodo Payments, who are.
• We are not HIPAA-compliant and do not sign BAAs. Don’t use CrispForms for protected health information.
• We do not yet hold our own SOC 2 report. Our infrastructure providers do; we don’t. If you need one from us, get in touch and tell us — that demand is how it gets prioritised.

Reporting a vulnerability

Email support@crispforms.com with the details and steps to reproduce. We aim to acknowledge within two business days.

We will not pursue legal action against good-faith security research. Please don’t access other people’s data, degrade the service for others, or run automated scans that generate significant load. Give us a reasonable window to fix an issue before disclosing it publicly.