Trust
Trust center
Formward is a European form backend. We store and process your form-submission data - and the personal data of the people who fill in your forms - in the EU/EEA; what leaves is what you route out, such as a notification mailbox hosted elsewhere or a webhook URL. This page summarises how we protect that data and where it lives. For the full detail, see our Security and Privacy pages and the compliance pack.
EU data residency
Your form-submission data is stored on infrastructure operated by Hostup AB in Sweden. The application and PostgreSQL database run on EU infrastructure; we use no US-based or non-EU cloud for submission data. Formward stores and processes form-submission data - and the personal data of the people who fill in your forms - in the EU/EEA; what leaves is what you route out yourself.
GDPR by default
The Service is built to be GDPR-compliant. We act as your processor for submission data, with a Data Processing Agreement available. Data-subject rights - access, export, and erasure - are self-serve from your account settings, and our legal bases are documented in the Privacy Policy.
Encryption in transit
All connections to the Service are encrypted with TLS 1.2 or higher. Backups, OAuth tokens and two-factor secrets are encrypted at rest; the live database volume relies on the hosting provider's physical and access controls rather than disk-level encryption. Account passwords are salted and hashed via better-auth and never stored in plain text.
Submitter IP protection
Submitter IP addresses are protected with a keyed hash (HMAC-SHA-256 with a secret server-side salt) immediately on receipt; raw IP values are never written to disk. Keyed hashing means the stored value cannot be linked back to an IP address without our secret salt.
Data retention you control
Submissions are retained according to your plan and the retention window you configure, unless you delete them earlier. The free plan keeps submissions for 30 days; paid plans let you configure the retention window. Pseudonymised IP values share the lifetime of the submission they belong to.
No advertising or profiling trackers
We do not run third-party advertising or analytics trackers that profile your visitors. Statistics about our own website and dashboard come from our cookieless first-party counter and Plausible Analytics, an EU-based service we never use on your forms or Pages. We use a minimal set of cookies: essential ones keep you logged in and store your consent choices, and the optional marketing category activates only with your consent via our consent manager.
Sub-processors
Every sub-processor that receives form-submission content is located within the EU/EEA. The table below summarises the sub-processor register, which is the canonical list referenced by the Data Processing Agreement.
| Processor | Purpose | Region |
|---|---|---|
| Hostup AB | Cloud hosting infrastructure and PostgreSQL database storing all submission and account data. | Sweden (EU) |
| Mailjet / Sinch | Transactional email delivery: submission notifications sent to form owners. | France / EU |
| Mistral AI | AI enrichment (spam scoring, summarisation, lead scoring), used only for Professional and Business forms with AI features switched on. Free and Personal submissions are never sent to Mistral. | France / EU |
| Stripe Payments Europe, Limited | Payment processing and subscription billing for paying customers; merchant of record. Receives billing and payment data only, never form-submission content. | Ireland / EU |
| Plausible Insights OÜ | Website and dashboard statistics (Plausible Analytics), cookieless: page views and two onboarding events (account created, form created). Receives page addresses with identifiers removed, the referring site's host, browser user agent and IP address, and stores neither the IP address nor the user agent. Never receives form-submission content. | Estonia / EU (data hosted in Germany) |
| Cloudflare | Optional anti-bot check (Cloudflare Turnstile), off by default and enabled per form by the form owner. Receives browser challenge data, never form-submission content. | Cloudflare, Inc. (USA) |
Two possible US transfers exist, both separate from form-submission content: Stripe Payments Europe, Limited may share paying customers' billing data with its US affiliates under Standard Contractual Clauses and the EU-US Data Privacy Framework, and the optional Cloudflare Turnstile anti-bot challenge (off unless a form owner enables it) involves a browser interaction with Cloudflare covered by an appropriate Article 46 safeguard. Forms without Turnstile enabled involve no non-EU/EEA processing.
Backups and recovery
We take daily encrypted backups of the PostgreSQL database and uploaded files, encrypted with a public key whose private half is held off the server, rotated on a 14-day cycle on the server, plus infrastructure-level snapshots by our hosting provider. Backups are kept on the server in Sweden, and each night an encrypted copy is also sent to a second server in Sweden, run by the same hosting provider, where it is kept for 30 days. Data may persist in encrypted backups for up to 30 days after deletion before rotating out.
Certifications
We do not currently hold a SOC 2 audit or ISO 27001 certification. A formal SOC 2 Type II programme is on our roadmap, and we will only publish a certification once it has been independently completed. In the meantime, our security and data-protection posture is documented openly across our Security, Privacy, and compliance pages.
Security questions or a vulnerability to report? Email security@formward.eu. For privacy and data-protection matters, contact privacy@formward.eu.