Most security pages are written to survive a lawyer. This one is written to be read. Here is where your form data sits, who can reach it, what happens to the people who fill in your forms, what a GDPR compliant form needs from you, and an honest list of the things Upform does not have yet.
4 →
Which email should we send your copy to?
Used once, to send you a record of your answers. Nothing else.
This form is protected by reCAPTCHA. Google's Privacy Policy and Terms of Service apply.
A published Upform form. The reCAPTCHA notice is a readable line inside the form, not a badge floating over your design.
RLS
Row-level security, every table
1
Account that can read your rows
v3
Invisible reCAPTCHA on public forms
$0
What any of this costs you
Isolation
Isolation in Upform is not a setting somebody remembers to switch on. It is the shape of the database. Every table holding your forms, your responses and your uploaded files carries a row-level security policy, and a query has to satisfy it before a single row comes back.
The policy lives on the table itself, not in application code. That means a query written by us, by a feature we ship next month, or by a mistake still has to prove which account it belongs to. Rows from another account are not filtered out of your result. They never enter it.
Who owns an account and who was invited to it is stored in a separate roles table, never as a field on a record you can edit. The check runs through a security-definer function, so the permission question is answered one fixed way. Editing your own row cannot promote you.
Files sent through a file upload question are stored against the form that collected them and read back through that same scope, so a path into one form's files is not a key to another form's. Free accounts get 100 MB, Pro is unlimited, and the scoping is identical on both.
The request path
Four things, in this order, every time. Whether the request comes from the builder, the responses table, the CSV export or an integration sending a row onward.
Every call is made as the signed-in person. Nothing is trusted because of where it came from or which screen it was fired from.
Row-level security is evaluated on each table involved before anything is returned. There is no path that skips it, including the ones we write.
Owner or invited member is read from the roles table through a security-definer function, so the answer does not depend on any value a user can edit.
An upload is read back through the form it was collected on. Ask for a file that belongs to a form you do not own and there is nothing to return.
Respondent privacy
Someone answering your public form does not have an Upform account and never makes one. So there is no user to attach the submission to, and Upform does not invent one.
An anonymous respondent is identified only by a visitor id generated in their own browser. It exists so the numbers in your Results panel mean something: one person opening the form twice should not read as two people. It is not an identity, it is not shared with other sites, and it is not sold to anyone.
The submissions table has no respondent column. A row holds the answers to the questions you asked and nothing else pointing back at a person. If you want to know who somebody is, you have to ask them, which is the right way round.
That is also where your contacts directory comes from. It is assembled from answers people typed into your forms: the name field, the email field, the company field. Never ask for an email and there is no email to aggregate.
Aggregate analytics is the one thing that goes slightly wider: your Results panel shows a desktop and mobile split and a country breakdown, counted across all responses rather than stored against any one of them.
Spam
A public form on the open internet gets found by bots, usually within days of the link going out. Upform runs invisible reCAPTCHA v3 on every public submission.
Version 3 scores traffic in the background instead of interrupting it. Your respondent sees no grid of bicycles, no checkbox, and nothing slows down. The form they finish is the same conversational flow described on conversational forms, with the spam check happening where they do not have to think about it.
Invisible checks carry an obligation in return: people should be told one is running.
Google's terms allow the floating badge to be hidden as long as the disclosure is visible in the flow instead. Upform takes that route and puts one plain line on every published form:
One readable sentence inside the form, rather than a badge hovering over the design you chose.
Status
Draft
Not published. The public link does not serve this form and nothing can be submitted to it.
PublishPublishing control
A form you are still building is private. Not unlisted, not merely hard to guess: unpublished. The public link does not serve it, and there is nothing to submit to.
This matters more than it sounds, because form data rarely leaks through an attack. It leaks through a half-finished draft that was reachable the whole time, or a link pasted into a shared document a year ago and forgotten. Publishing is a deliberate step you take when the form is ready to be seen.
When you do publish, everything for sharing sits in one panel: the public link, the iframe embed and the email snippet. On Pro you can invite up to five teammates with granular permissions, and each invite stays at pending until that person accepts or declines.
Build a form freeBeing straight with you
The fastest way to waste a week is to discover in the third round of a security review that a box was never ticked. So here is both columns, up front, before you build anything.
If your procurement process needs anything in the right-hand column, email hello@upform.com or use the contact form before you build. We will tell you plainly whether Upform fits. A same-day no is worth more to both of us than a slow maybe.
Practical, not legal
We are not your lawyers and none of this is legal advice. It is the short list of things that actually go wrong on forms, and every one of them is a decision you make in the builder rather than a feature you buy.
Every field is a liability as well as a question. A quote request does not need a date of birth. Cut anything you cannot name a use for this quarter, and the form converts better as a side effect. Form design best practices covers the trade-off.
Use the help text under a question to say what happens to the answer. "So we can send your copy." "Only the two people on this account see this." One question per screen makes that easy, because the reason sits next to the question instead of in small print nobody reads.
Consent is a decision, not a default. Give it its own Yes/No step with plain wording, leave it unselected, and never bundle "add me to the newsletter" into "send my quote". If answers will be pushed to a marketing tool, say so before the person presses OK.
Agree how long you keep responses while you are building the form, not on the day somebody asks you to delete theirs. Responses sit in a searchable table with a CSV export, and the contacts directory groups every submission from one email address, so a request about one person is a search, not an archaeology project.
Each connected destination is another place the data lands. Integrations are connected with your own account, so answers go to systems you already control. But list them in your privacy notice anyway, because your respondents cannot see your integration panel.
Compliance is a property of how a form is used, not a badge a tool wears. Upform gives you the parts that are ours to give: your data isolated per account by row-level security, a data processing agreement, a privacy policy in plain English, and control over every field you ask for. What you collect, why you collect it and how long you keep it is yours to decide, and that is the part a regulator looks at. We are not lawyers and this is not legal advice.
Row-level security is enabled on every table that holds your data, and the policy sits on the table rather than in application code. A query has to satisfy it before any row comes back, so rows belonging to another account never enter the result in the first place. Roles are stored in their own table and checked through a security-definer function, which means editing a record you own cannot change what you are allowed to see.
No. An anonymous respondent is identified only by a visitor id generated in their own browser, so your Results panel can tell one visit from ten. The submissions table has no respondent column: a row holds the answers to your questions and nothing else pointing at a person. Your contacts directory is built from the answers people typed, so if you never ask for an email address, there is no email address.
Public submissions run through invisible reCAPTCHA v3, which scores traffic in the background with no puzzle for the respondent to solve. When the floating badge is hidden, the disclosure has to be visible somewhere in the flow instead, so every published form carries one short line saying the form is protected by reCAPTCHA and pointing to Google's privacy policy and terms. A readable sentence inside the form beats a badge hovering over your design.
No, and we would rather say so on this page than in week three of your review. There is no SOC 2 report, no HIPAA business associate agreement, no ISO 27001 certificate and no choice of data residency today. If your procurement needs any of those, email hello@upform.com before you build anything and we will tell you plainly whether Upform fits.
Yes. Row-level security, the separate roles table, per-form upload scoping, reCAPTCHA on public submissions and forms staying private until you publish them apply to every account on both plans. Pro adds unlimited file storage, branding removal, up to five team members and early access to new features. Nothing about how your data is isolated changes when you pay.
Get started
Build one, publish it, and look at what a submission actually holds. That is a faster security review than any questionnaire, and it costs nothing.
No credit card. Unlimited forms and responses on the free plan, with the same isolation rules as Pro.