Security and Trust

• Formasty runs on managed Cloudflare infrastructure with isolated environments and environment-scoped secrets.
• Network traffic is encrypted in transit, and sensitive operational credentials are not embedded into client bundles.
• Uploads and generated assets are stored through managed object storage with lifecycle controls.

• Workspace permissions are role-based and enforced server-side.
• Billing, member management, privacy tools, and API secrets are restricted to authorized workspace roles.
• Administrative and privacy-sensitive actions are recorded in audit events.

• Response, upload, session, webhook-log, and audit retention windows are enforced through scheduled cleanup jobs.
• Paid configuration is preserved after downgrade but can become read-only or inactive instead of being destroyed.
• Workspace owners can search, export, delete, or anonymize respondent submission data through privacy tooling.

Formasty maintains an incident workflow so suspected security events can be triaged, audited, and escalated. Where Formasty acts as a processor, customer notification is designed to happen fast enough to support the controller's own GDPR reporting obligations.

Security questions or coordinated disclosure reports can be sent to support@formasty.com.