The short version
Your forms and the answers in them are yours, and keeping them safe is part of the product, not an add-on. This page says what Formkit does to protect them, in plain words. What it says is how Formkit works today; when that changes, this page changes with it.
Your account
Sign in with a password, Google, or a passkey (Face ID, a fingerprint or your device's PIN).
Two-factor sign-in with an authenticator app is available on every plan, with recovery codes that each work once. A passkey counts as two-factor on its own.
Wrong two-factor codes lock the code step for 5 minutes, then longer each time, up to a day. It counts across all your browsers, and you are told the first time it happens.
Passwords are never stored in readable form, and the secret behind your authenticator app is encrypted.
You get an email and an in-app notice when your account is signed in from a browser it hasn't used before, and you can sign out every other session from Settings.
On Business, require sign-in with your company's Google Workspace for everyone at your domain.
Email to the people who answer
A form's confirmations, AI replies and quiz results go only to the address typed into the form's own email question, so a form can't be used to send mail to strangers. No address receives more than 5 such emails a day from all of Formkit, and an account's forms together send at most 200 a day on Free, 2,000 on Pro and 10,000 on Business. Every email sent, and every one skipped, is in the form's email log.
Your data
Everything is encrypted in transit and at rest. Keys and tokens Formkit holds for you (your Stripe key, sign-ins to Google Sheets, Notion, Airtable and HubSpot) are encrypted again with a key kept apart from the database.
API keys are stored only as hashes and can do only what you ticked when you made them. Apps you connect see only what you allowed on the consent screen.
Webhooks are signed so you can check they came from Formkit, and they go only to public addresses, checked before every delivery.
Data is stored in the United States, with Convex and Vercel. The full list of companies that help run Formkit is in the data processing agreement.
Formkit doesn't sell data, show advertising, or train AI on your responses. Formkit AI sends Google's Gemini models only what a request needs, as the privacy policy describes.
Delete a response, a form or your account whenever you like. On Business, set responses to delete themselves after a period you choose.
Formkit staff
Only the people who run Formkit can reach production systems, and every staff account must use two-factor.
Staff look at an account only to answer a ticket, look into a report or investigate abuse. That view is read-only and every visit is logged.
Business accounts get an audit log of who did what in their own company.
How Formkit is built
Every change is checked before it ships: typechecks, more than 200 automated tests, browser tests, a scan for keys or tokens committed by mistake, and a check of every package the app ships against known vulnerabilities.
Dependencies are watched, and updates for known vulnerabilities are proposed automatically.
Errors are reported so they can be fixed, with tokens removed from links and email addresses masked; answers are never included.
Found a problem?
If you think you've found a security problem in Formkit, write to hello@formkit.app with “Security” in the subject, what you found and how to see it. Please give us a chance to fix it before telling anyone else. We answer within five working days, and we'll tell you when it's fixed.
For the legal detail, read the privacy policy and the data processing agreement. Questions go to hello@formkit.app.