ViaForm
Back to home

Security & Compliance

An overview of the security practices built into ViaForm today.

Data in transit

ViaForm is served over HTTPS with TLS 1.2 and 1.3. Plain HTTP requests are redirected to HTTPS.

  • HTTP Strict Transport Security is enabled, and a Content Security Policy is set.
  • ViaForm pages cannot be embedded in frames on other sites. Public forms can be embedded where their owner allows it.

Sign-in and account security

ViaForm supports email and password sign-in with a minimum password length of eight characters, password reset by email, and email sign-in codes. Verification emails are also sent.

  • Google, Microsoft, or Apple sign-in is available where enabled.
  • Passwords are stored as scrypt hashes, never in plain text.
  • Rate limiting is applied to sign-in, sign-up, password reset, and verification requests.

Access control within your organization

Organization data is scoped to the organization on each request, and membership is checked.

  • Role-based access uses owner, admin, and member roles. Sensitive organization actions are limited to owners or admins.
  • Uploaded files are available only through short-lived signed links issued to signed-in members of the organization.

Activity log

Administrative changes to members, groups, permission sets, and organization settings are recorded in an activity log.

Deleting your account

You can delete your account in settings. Personal account data is removed and form responses are anonymized. A sole organization owner must transfer ownership first.

Formal certifications

ViaForm does not currently hold formal security certifications or third-party attestations. This page describes our practices, not a certification.

These documents are currently available in German.