Security

A form backend holds other people’s names, emails and messages. Here is exactly how FormRill handles them today, and what is still on the way.

Architecture

Runs on Cloudflare. The API runs on Cloudflare Workers and data is stored in Cloudflare D1. Every request goes through Cloudflare’s network, including its DDoS protection.
HTTPS everywhere. The form endpoint and dashboard are served over HTTPS, and every outbound delivery we make uses HTTPS. Webhook, Sheets, n8n and CRM destinations must be https:// URLs; we refuse to save anything else.
Stored before delivery. Each submission is written to the database before any email or webhook is attempted. A failing destination can delay a delivery, never lose the submission.
Email sending. Notification emails are sent through our email-sending service on AWS, which receives only the email it is asked to deliver.

Protecting your form

Unguessable IDs: Every form ID carries 128 random bits from the platform’s cryptographic random generator. IDs are not sequential, so forms can’t be found by counting.
Submit-only URLs: The public form URL can create submissions and nothing else. It can’t list, read or change data.
Domain whitelist: Optionally restrict a form to your own domains. Submissions whose Origin (or Referer) isn’t on the list are rejected, and so are requests that send neither.
Honeypot: A hidden botcheck field catches bots without a CAPTCHA. Submissions with it filled in are kept in your Spam folder and never emailed or sent to your automations.
Size limit: Submissions over 100 KB are refused.

Protecting your account

Hashed tokens. Dashboard access tokens are stored only as SHA-256 hashes. A copy of our database would not contain a usable token.
Scoped queries. Every dashboard request is checked against the account that owns the form, so one account can’t read another’s data.
Client review links. Each link is a separate 128-bit secret for one form. It shows only that form’s submissions, and replacing it immediately disables the old link.

Known limits, stated plainly

Signup emails you a private sign-in link, and you can request a new one from the login page; requesting a new link signs out your other devices. That sign-in has full access to your account: read-only tokens are planned.
Outbound webhooks are not signed yet. Use a long, secret destination URL.
There is no per-form rate limiting yet; the honeypot, domain whitelist and Cloudflare’s network protections are the current controls.
We don’t yet hold third-party certifications such as SOC 2.

Coming soon

AI spam scoring with quarantine Coming soon
Read-only tokens Coming soon
Signed webhooks Coming soon

Report a vulnerability

Email hello@formrill.com with “Security” in the subject. Please give us a reasonable time to fix an issue before disclosing it. We reply to every report.

Your submissions, protected from the first one

Free up to 500 submissions a month and unlimited forms. No server, no credit card.

Start free

Privacy
What we collect, subprocessors and retention.
Submission API reference
Domain whitelist and honeypot behaviour in detail.