Security and privacy.
FormRoute keeps the result of each submission, never its contents, and sends from a domain only you can authorise.This page describes how FormRoute handles data today. Questions or a security report: [email protected].
What FormRoute keeps.
And what it never does.- Your account
- Your name, email address and a hashed password.
- Your form
- Its name, recipient, allowed websites and field rules.
- Each submission
- Time, result, the check that stopped it, the website it came from, delivery status and a keyed hash of the visitor's IP.
- Never
- What the visitor wrote. Field values go to your inbox and are not stored.
Submissions.
Checked, delivered, then forgotten.Contents go to your inbox only. The values a visitor types are put into the email and handed to Amazon SES. FormRoute's database has no column for them.
Visitor IPs, hashed. An IP address is used for rate limits, in counters that expire after about a minute. Submission records hold only a keyed hash of it, and it is never written to logs.
Only your fields. Anything a form sends beyond the fields you set up is dropped before sending, and no submission may exceed 20 KB.
Recipient fixed. Visitors cannot choose where a submission goes, which address it comes from or which server sends it.
Sending.
Your domain, authenticated.DKIM-signed. Mail is signed for your domain through three DKIM records you add during setup, so receiving servers can check it really came from you.
Ownership proven per account. Besides the DKIM records, each account publishes its own TXT record. Nobody else can register your domain in their FormRoute account and send as you.
Isolated sending. Each account sends through its own Amazon SES tenant, and its bounces and complaints are tracked separately.
Transactional only. One submission, one email to the recipient you chose. Bulk and marketing mail are not allowed.
The platform.
Encrypted in transit. Every page and API call is served over HTTPS with HSTS. Pages cannot be framed by other sites.
Verified webhooks. Payment events from Stripe and delivery events from Amazon are accepted only with a valid signature.
Hashed passwords. Sign-in passwords are stored as one-way hashes, and every page checks your session on the server.
Backups. The database is backed up every night.
Service providers.
The companies FormRoute relies on to run.- Amazon Web Services
- Amazon SES sends your mail from Stockholm, Sweden (eu-north-1).
- Stripe
- Payments, invoices and subscriptions. Card details go to Stripe, never to FormRoute.
- Cloudflare
- Sits in front of form-route.com, and provides the Turnstile CAPTCHA.
- Sentry
- Receives reports of server errors so they can be fixed.