Loading page
Security
No certifications to display and no “bank-grade” claims. This page lists the controls that exist in the product, so you can decide whether they meet your bar.
Anyone can POST to a form endpoint — that is the product. What they cannot do is read. The endpoint never exposes a listing, a submission body or an id belonging to someone else; retries return only the submission the caller just created.
Because a form id in public HTML is not a credential, protection comes from what can be enforced server-side: structural validation, rate limits stored in the database, per-form quota checks inside the insert transaction, and optional browser-origin allow-lists.
A submission can only be read by a signed-in workspace member, or by a client holding an active permission for that specific form. The check derives ownership from the signed-in session and the ownership chain, never from a form id, submission id or workspace id supplied in a query string.
Client permissions are checked on every request, so revoking access takes effect immediately — there is no cached session to expire.
Row Level Security is enabled on every application table. Policies scope forms to their owning workspace, submissions to forms the caller can view, and leave roles, billing, usage and audit tables writable only by trusted server logic.
Roles live in a separate table with no write policy, so a profile update can never promote an account to developer.
The test suite creates two clients, two workspaces and submissions in each, then attempts cross-access with modified identifiers. Access is rejected, and revocation is verified to close the door on the next query.
The Supabase service role, the email provider key and the billing API key are read through server-only modules. Error messages name a missing variable, never its value. Webhook signatures are verified with a timing-safe comparison and replayed events are rejected by provider event id.
Responses carry a Content-Security-Policy, HSTS, X-Frame-Options, a referrer policy, Permissions-Policy, COOP and nosniff. Authenticated areas are explicitly marked private and non-cacheable so a shared cache can never store a dashboard page.
Email team@formivo.faizyab.me with steps to reproduce. Please do not test against other customers' data; use your own workspace. We will confirm receipt and tell you what we fixed.
The full endpoint contract is in the documentation.