Security overview

Last updated: September 29, 2026

This page describes how Upform protects the accounts, forms and responses in its care, and where the limits are. For the plain-language product tour, see Security and privacy. How we handle personal data is set out in our Privacy Policy and, for form creators, in our Data Processing Agreement. These measures apply to every account, Free and Pro alike. No online service is perfectly secure, and this page does not promise otherwise.

Where Upform runs

Upform is built on Supabase, a managed platform that provides:

• Database: managed Postgres for accounts, forms, responses and form analytics events.
• Authentication: sign-in by email and password or with Google, and password reset by email.
• File storage: files uploaded to Upform, including files respondents send through a File Upload question.
• Edge functions: server-side code for tasks such as verifying reCAPTCHA and sending responses to connected integrations.

The web application at app.upform.com is hosted by [App hosting provider]. Your data is stored in [Data hosting region], and you cannot currently choose a different region.

How data is encrypted

In transit. The app, published forms and this website are served over HTTPS, so traffic between a browser and Upform is encrypted with TLS. Responses sent to connected services go to their HTTPS APIs. A custom webhook or n8n request goes to the URL you enter, so it is only encrypted if that address starts with https://.

At rest. We rely on the encryption at rest that our infrastructure provider applies to its managed database and file storage, and we make no separate claims about key management beyond what that provider offers.

Who can reach your data

Access rules are enforced in the database itself, not only in the interface you see.

• Row-level security on every public table. Each public table has row-level security enabled, with explicit grants. A query must satisfy the table's policy before any row is returned, and the policies limit each account to its own forms and responses and to any workspace it has joined.
• Roles checked on the server. Roles live in a separate table and are checked through a security-definer function. They are never read from a profile field you can edit or from your browser's storage.
• Team workspaces. On Pro, you can invite up to 5 team members by email, with granular permissions, and they share the owner's workspace. An invite stays pending until the person accepts or declines it.
• Forms private until published. An unpublished form is not served on its public link and cannot receive submissions. A published form can be opened and submitted by anyone who has the link.
• Uploads scoped per form. Files from a File Upload question go to a storage bucket scoped to the form that collected them and are read back through that same scope.

Passwords are stored by the authentication service in hashed form, not as readable text. If you sign in with Google, Upform never receives your Google password.

How respondent data is handled

Respondents do not have an Upform account, and a submission is not linked to one. It holds the answers to the creator's questions. To count visits accurately, the form keeps a random visitor ID (upform_visitor_id) in the respondent's browser. Form analytics record views, starts, submissions, completion time, device type (desktop or mobile) and country.

For respondent data, the form creator is the controller and Upform is the processor. We process answers and form analytics on the creator's instructions, as described in the Data Processing Agreement.

How integrations and webhooks are secured

Integrations are connected per creator, through OAuth, using the creator's own account: Google Sheets, Slack, HubSpot, Klaviyo, Mailchimp, monday.com and Notion. We never ask for your password to those services, and in Notion only the databases you explicitly share with Upform are available. When a form is submitted, the answers are stored and sent to every integration the creator has connected.

• n8n: each request is signed with HMAC-SHA256 in an X-Upform-Signature header, so your workflow can confirm the request came from Upform. No n8n credentials are needed.
• Custom webhooks: answers are sent to the URL you enter. Use an https:// address that you control, and keep it private.
• Google Analytics: connection only. No response data is sent to it.
• Google Forms: a one-way import into Upform. Nothing is sent back to Google Forms.

You can disconnect an integration at any time. Once answers reach a connected service, that provider's own terms and security apply.

How public forms are protected from spam

Published forms use invisible Google reCAPTCHA v3, and only on public submissions. It scores traffic in the background with no puzzle to solve, and the result is verified on our server, not in the browser. reCAPTCHA is a Google service, so Google receives information from the respondent's browser to produce that score, and every published form shows a short line saying it is protected by reCAPTCHA and that Google's Privacy Policy and Terms of Service apply. reCAPTCHA reduces automated spam, but it cannot guarantee that every submission comes from a real person.

What we do not have

Upform does not currently have any of the following. We would rather you learn this here than halfway through a procurement review.

Because we do not sign a HIPAA BAA, do not use Upform to collect protected health information where your use requires one, for example as a HIPAA covered entity or business associate. If your review needs anything in this table, email hello@upform.com before you build and we will tell you plainly whether Upform fits.

What you are responsible for

Security is shared. These parts are in your hands:

• Protect your sign-in. Use a strong, unique password, or sign in with Google and turn on 2-Step Verification for that account. Keep your email account secure too, because password reset links are sent there.
• Choose who you invite. Team members share your workspace and, depending on their permissions, can see its forms and responses. Invite only people who need that access, and remove them when they leave.
• Ask only for what you need. Do not ask respondents for passwords, full payment card numbers or anything you have no use for, and use help text to explain why you ask for anything sensitive.
• Publish deliberately. Unpublish forms you no longer use, so they stop accepting submissions.
• Review your connections. Every connected integration receives each new submission. Disconnect tools you no longer use, and verify the n8n signature in your workflow.
• Look after your exports. Once you download a CSV of responses, that copy is under your control.
• Inform your respondents. As the controller, you are responsible for your own privacy notice, for having a lawful basis to collect the answers, and for telling respondents which tools receive them.

If a security incident happens

If we become aware of a security incident that affects your account data or your respondents' data, we will investigate it, take steps to contain it, and tell affected form creators without undue delay, as applicable law requires, sharing what we reasonably can so you can meet your own obligations as controller.

How to report a security issue

If you believe you have found a vulnerability in Upform, email hello@upform.com with the subject "Security". Please describe the issue and where it occurs (a URL or feature), the steps to reproduce it, and what you believe an attacker could do with it.

We will acknowledge your report, investigate it, and keep you updated on what we find. Please give us reasonable time to resolve the issue before you share details publicly. We do not run a paid bug bounty program.

While you research, please:

• Test only against accounts and forms that you own.
• Do not access, change or delete other users' data. If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
• Do not disrupt the service, for example with denial-of-service attempts, load testing or mass automated submissions.
• Do not use phishing or social engineering against our team or our users.

Changes to this page

We update this page when our security measures change, and the date at the top shows the latest revision. Questions about anything here? Email hello@upform.com.