Security

Last updated: August 13, 2026

Security at Nextforms is built into how the product works, not bolted on. This page lists what we actually do — no vague promises.

Data protection

Encryption in transit. All traffic to and from Nextforms uses TLS.
Encrypted credentials. Credentials and OAuth tokens for your connected services are encrypted at rest. Passwords are stored hashed, never in plain text.
No card data. Payments are processed by Stripe; full card numbers never touch our servers.
Tenant isolation. Every form, submission, workflow, and connection is scoped to your organization at the data layer.

Account security

Multi-factor authentication is available for all accounts, free.
Team roles let you control who in your organization can edit forms and workflows.
Log in with Google or Microsoft if you prefer not to manage another password.

Abuse and deliverability protection

Bot protection on account and form endpoints via Cloudflare Turnstile, plus honeypot and rate-limit defenses on public form submission.
Velocity caps that stop submission floods before they become anyone’s problem.
Bounce and complaint handling with automatic suppression, protecting the email deliverability every customer depends on.

Deletion that means it

Deleting a submission is immediate and permanent — including uploaded files, which are purged from object storage, and associated workflow runs.
Deleting your account permanently removes your data within 30 days.
Every published form version is retained for historical accuracy, so past submissions always render exactly as they were submitted.

Infrastructure

Nextforms runs on established cloud infrastructure providers that maintain industry-recognized certifications for their physical and platform security. The full list of subprocessors is in our Privacy Policy.

Reporting a vulnerability

Found something? We want to know: [email protected]. We commit to acknowledging reports promptly, and we won’t take legal action against good-faith research that respects our users’ data.