Security you don't have to build yourself.
Receiving form submissions safely means handling encryption, spam, validation, and abuse. formbuild.io does that for you, so a simple contact form doesn't become a security liability.
Encrypted in transit
Every connection to formbuild.io — the submission endpoint, the dashboard, and the API — is served over HTTPS/TLS.
Modern password hashing
Account passwords are hashed with Argon2id. We never store passwords in plaintext, and staff cannot read them.
Server-side validation & sanitization
Submissions are validated and sanitized on the server, and output is HTML-escaped, so malicious input can't reach your inbox or dashboard.
Spam filtering
A honeypot silently drops bots on every plan, with reCAPTCHA available on Pro for higher-traffic forms.
Rate limiting
Submission and sign-in endpoints are rate limited to blunt abuse and brute-force attempts.
Content Security Policy
The app ships a strict, per-request nonce-based CSP so injected scripts can't execute — defense-in-depth against XSS.
Your data, your control
Export your submissions at any time, and deleting your account erases your data — including from our analytics processor.
Consent-based, first-party analytics
Product analytics are first-party and only run after you consent. We never sell data or use third-party advertising trackers.
Reporting a vulnerability
Found a security issue? Please email security@formbuild.io and we'll respond promptly. See our privacy policy for how we handle personal data.