Security

Where your answers are, and how they're kept.

The facts a cautious buyer asks for, in one place. Last updated 31 October 2026.

Hosting

Everything runs on a server in Hetzner's data centre in Helsinki, Finland, in the EU, operated by GestureLoop, an Irish company. There is no US hosting, no CDN in front of the answers, and the people answering a form are never sent anywhere else to fill it in.

In transit

Every page and every form is served over HTTPS with certificates from Let's Encrypt, and the site tells browsers to use HTTPS only (HSTS) for a year. Pages carry the usual protective headers: no content sniffing, no framing of the app's pages by other sites (forms themselves may be embedded, since that's what they're for), and a referrer policy that keeps form addresses off other people's logs.

At rest

Answers, files and account details live in a database and a file store on that server, on encrypted disks. A snapshot is taken every night, checked for integrity, and kept for 30 days on the server and 90 days in a separate storage box, with weekly copies kept for a year. Restoring from a backup is a documented, tested procedure.

Accounts

• Passwords are hashed with scrypt and never stored or logged in clear; at least ten characters.
• Five wrong tries lock an account for fifteen minutes.
• Email links (confirmation, password reset, invitations) are single-use, expire, and only a hash of the token is stored.
• Sign in with Google uses only the openid, email and profile scopes.
• Session cookies are secure, HTTP-only and same-site.
• Every organiser action on a workspace is written to a log with who did it.

Forms and answers

• Every answer is checked on our side; nothing is stored until all of them pass.
• Uploaded files are checked by their contents, not their names; images used on forms must really be images, and SVG is refused because it can carry scripts.
• Answers' files are served only to the form's organisers, as downloads, never inline.
• Bots are caught by a hidden field, a signed time stamp and rate limits, with no CAPTCHA for people.
• Webhook calls are signed with a per-form secret so your system can verify they came from us, and are only ever made to public addresses.
• A form in another workspace is a 404, never a 403: the system doesn't confirm what it won't show.

Money

Card details never reach our servers. Plans are paid through Stripe Checkout, and payments inside forms go to the organiser's own Stripe account through Stripe Connect; we see the outcome, not the card.

Third parties

Hetzner (hosting, Finland), Resend (email, EU region), Stripe (payments), and, only when an organiser connects them, Google (Sheets) and the chat or automation services they send responses to. AI drafting sends a form's wording to a model through Yohanun, never the answers; only a form its organiser sets to a conversation sends what the person types, and they're told first. The full list with roles is in the privacy statement.

Deleting

Deleting a response deletes its files; deleting a form deletes its responses, files, pictures and versions; backups age out on the schedule above. Closing an account is a message to us while the self-service version is built.

Agreements and reports

The data processing agreement (GDPR Article 28) is part of the terms for every workspace, and Business customers get it signed. If you find a security problem, tell us and we'll answer quickly and fix it before saying anything publicly; we'll credit you if you like.