JotForm Logo

Why is JotForm Secure?

SSL

Regardless of your plan, all your forms are served across protected 256 bit SSL (Secure Socket Layer) connection that uses a SHA256 Certificate. This is the same level of protection used by online banking or e-commerce providers. Read More

You can easily encrypt your forms to ensure that submission data is transferred and stored in a secure format and no one else can read it. Submissions are encrypted with high-grade RSA 2048 right at user's computer then transferred and stored in our servers securely. Read More

We are the first and only form builder with PCI DSS Service Provider Level I compliance, the highest security attainment you can have as a business that collects payments from, and integrates with, credit cards. Read More

JotForm is fully compliant with the European Union’s General Data Protection Regulation (GDPR), the data protection law taking effect on May 25, 2018. This applies to any business that collects data in or from Europe. Read More

Healthcare providers collect patient information through JotForm’s HIPAA-compliant forms. A Business Associate Agreement (BAA) is also available upon request. Read More

In addition to the Captcha’s that you can use in your forms, we have several other options to protect your forms from spammers. For example, you can choose to allow only one submission per IP or computer, or you can disable your form after a specific time or number of submissions.

In privacy settings, you can limit access to your data depending on the level of privacy that you choose. You can also disable cloning of your forms or require a login to access a submission (this is by default protected via unique URLs).

How you can make your forms even safer?

01. MAKE YOUR FORMS ENCRYPTED

You can easily encrypt your forms to ensure that submission data is transferred and stored in a secure format. JotForm uses the RSA-2048 algorithm while encrypting your form data. Since you own your encryption key, use caution storing it. If you lose your key, it is impossible to access your encrypted data anymore.

When you enable this feature and get a submission, notification emails sent by JotForm does not include any form submission data. You can learn more about how to encrypt your forms here.

File uploads are not covered within this feature. You can read about file upload security from this post.

02. SET PRIVACY OF YOUR FORMS AND DATA

Access to submissions of a form is protected and requires login to the account which owns that form. However, a single submission can be viewed if the unique, and almost impossible-to-guess URL of that single submission is known. If you think that you want additional privacy, you can add an extra layer of protection and require login in addition to the security provided by unique URL.

Since you have total ownership of your forms and submissions, access to your data is granted only with your permission when you use an integration widget and/or app. Rest assured that we treat your data with the utmost confidentiality.

03. KEEP YOUR EUROPEAN USER DATA IN EUROPEAN SERVERS

As a JotForm user, you can choose to have your data stored only in the European Union (EU). You can change your data center setting in the “Data” tab of your account settings. From the same screen, you can move your data to our European data center.

If you choose to have your data stored only in the EU, it will be hosted in a data center in Frankfurt, run by Amazon Web Services. You can get more information about EU Safe Forms here.

JotForm is also fully compliant with the EU’s General Data Protection Regulation (GDPR). See above for more details.

04. BACKUP YOUR DATA

You can backup your data with a single click from the “Data” tab in your account settings. When you trigger a backup operation, we start preparing a single ZIP file that contains the HTML code for your forms, a CSV export of your form submissions, and any uploaded files.

These backups can either be downloaded or stored in our database. If you wish to take backup of your forms only, it is also possible to download their source code in zip format and store in your local storage from Publish options.

05. KEEP YOUR FORMS SAFE FROM SPAMMERS

JotForm offers two different CAPTCHA alternatives to make it difficult for bots to fill out your form, while still keeping it easy for people. You can either use a basic CAPTCHA or reCAPTCHA, as provided by Google.

We’ve also implemented multiple coding checks within the submission process to analyze if the submission is coming from a person. If spam does get through, our 24/7 support team will help identify the cause and credit your account, if necessary.

As an additional spam protection, you can also limit submissions to your form so that only one submission can be made from one IP address, or one computer. If you prefer, you can also enable both for greater protection. Furthermore, you may also choose for your forms to be disabled at a specific time or after a specific submission limit has been reached.

What measures do we take to protect your data?

Data Centers

JotForm servers are co-located in a cloud based architecture with Google Cloud and Amazon Web Services (AWS). Google Cloud data centers are hosted in Iowa (US). AWS data centers are located both in Germany, Frankfurt (EU) and US, Virginia (US).

Google Cloud servers host our redundant application and data servers in active-active configuration and all data is also replicated to AWS servers continuously. This provides a platform level redundancy in addition to the redundancy obtained with multiple servers within single platform. In case we need to switch from primary platform (Google Cloud) to the secondary platform (AWS), this architecture helps us for an easy and fast switch.

Hosting JotForm at these major cloud platforms also provides us some extra benefits in means of implementation of security best practices in areas like hardware lifecycle management, physical security and network infrastructure. Our servers are constantly updated and patched.

Backup Policy / Business Continuity

We continuously replicate (backup in real time) your data between multiple servers hosted by our primary service provider Google Cloud. Additionally, all data is also replicated to AWS (our secondary platform) in real time. We take snapshots of our all data every hour. Each snapshot is stored for 30 days in the cloud environment.

Encouraging Best Coding Practices

In addition to implementing features that increase security, we maintain best practices on the backend to ensure your account remains secure. We monitor sessions to restrict access of your account appropriately, and have constructed JotForm in a way that every account is isolated.

We have put safeguards in place to detect common attacks, such as SQL injection and cross-site scripting. Most importantly, we actively review our code for potential security concerns (in addition to evaluating all user feedback) so that we can address any issues if they arise. Our privacy statement speaks to our level of commitment to ensuring your data is not misused.

All developed code is deployed to production environment only after certain procedures including tests run on staging systems. Our continuous deployment system and development process allows us to rapidly update and patch our system whenever needed.

Security Audits

PCI scans are performed to detect any kind of vulnerability of the publicly available interfaces regularly. Each quarter internal and external ASV (Approved Scanning Vendor) tests are performed for PCI. In addition to these PCI scans, Pen-tests are performed periodically for JotForm.

We also have a Bug Bounty program where we pay outside parties for reporting vulnerabilities which ensures that we are the first to know about them. We fix all issues reported to our bug bounty program with highest priority in the shortest time.

Network Security

We have an outside routing layer provided by CloudFlare that provides basic filtering to handle and manage any potential DDoS (denial of service) attacks. Security scans are performed periodically as described in the audits/VA/PT chapter. Our servers are configured to allow only the absolute minimum level of access needed to maintain them.

All unnecessary users, protocols, and ports are disabled and monitored. Our employees are able to access the servers only through a Virtual Private Network using a 2048-bit encrypted connection with private keys. In addition to 3rd-party security services, our experienced development operations team continuously monitors any suspicious behavior on the entire system.

Account Security

Forms are linked to only your account and account information is transferred only in encrypted format. If you want someone else to access your forms directly, it is possible to create sub-users and set access rights to each form and/or its submissions individually.

Questions & Answers

form security questions

  • Are there any security features available in the forms?
    Yes. Your forms are served across a protected, 256-bit Secure Sockets Layer (SSL) connection. When you choose to encrypt your forms, submissions transferred and stored after being encrypted with RSA-2048 key at internet browser of the user. Additionally, you can enable extra privacy and spam protection as defined under “How you can make your forms even safer?” section above.
  • Do you store all encrypted form data? Do you send notification emails for encrypted forms?
    If you wish to encrypt your forms, the submissions are transferred and stored encrypted. However, file uploads are not encrypted. Notification emails for these forms cannot contain any submission data, and therefore are not encrypted.
  • Is our data protected, both in-transit and at-rest, if we were to use your system?
    Yes, if you encrypt your form, submission data is encrypted right at the user’s internet browser with RSA 2048. This encrypted data is once more encrypted during transmission to our servers with 256 bit SSL encryption. And when it reaches our servers SSL is decrypted and it is stored as encrypted in user’s computer with RSA 2048 key.
  • Can search engines index my form data?
    Form submissions are not accessible to the public. Therefore, it is not possible for search engines to access and index them.

data security questions

  • How do you store uploaded files to my forms?
    Files uploaded to your forms are assigned a very complex URL. Only people having this URL can download these files. However if you want increased security for your file uploads, you can restrict access. For example, to be able to download these files requires you to be logged in to your JotForm account within same browser. You can read more about this feature here.
  • What backups do you perform? What are the backup policies for cloud storage?
    We continuously replicate (backup in real time) your data between multiple servers hosted by our primary service provider Google Cloud. Additionally, all data is also replicated to AWS (our secondary platform) in real time. We take snapshots of our all data every hour. Each snapshot is stored for 30 days in cloud environment.
  • Does your organization handle credit card transactions or information? If so, are you PCI DSS compliant?
    JotForm is PCI DSS compliant and is Payment Credit Industry Data Security Standard (PCI DSS) Service Provider Level I certified, the highest security attainment you can have as a business that collects payments from, and integrates with, credit cards. That is, while most of the payments are processed in processors own page, for PayPal Pro, Authorize.Net, Worldpay US and PayJunction, credit card information is processed over our PCI servers, but not stored in any way. read more here.
  • What are JotForm’s security (HTTPS / Encryption) standards?
    We have an SSL certificate that uses SHA256 with RSA encryption for HTTPS. For encryption of form submissions we use 2048 Bit RSA Keys.
  • How do you prevent XSS and SQL injections?
    We apply best practices to prevent such vulnerabilities and we actively review our code for potential security concerns. Additionally, we evaluate all user feedback and bounty program reports in the shortest time possible.
  • What do you use for security protection against malicious attacks?
    We use CloudFlare for spam, phishing, and DDOS attack protection and OSSEC for intrusion detection and monitoring our servers.
  • Who has access to the information gathered in our database at JotForm?
    Our servers have restricted access by network and authentication level. On a network level, only a limited number of VPN entry-points are allowed, and the rest of the connection requests are completely blocked by our firewall. On an authentication level, only the Development Operations team, plus our CTO and CEO, have credentials to access these servers.
  • Do you conduct any internal or external vulnerability assessments or penetration testing?
    Yes. In addition to internal and external PCI scans, Pen-tests are performed periodically for JotForm. Also we have a bounty program where outside parties report vulnerabilities. You can Read More about it in Security Audits section above.
  • What is your company’s password complexity policy?
    We don't have password complexity policy. Passwords are encrypted with salt and SHA-256.
  • Does your company have an intrusion detection policy?
    Yes, we apply OSSEC policies used to detect any intrusion. Additionally, PCI intrusion detection policies are being applied, as defined by PCI requirements.
  • What type of due diligence is performed on employees of your organization?
    All JotForm employees must pass a rigorous screening process at the time of hiring. Additionally, all employees must sign and are bound by a non-disclosure agreement (NDA).

data center questions

  • What are Data Security at your datacenter and any certificates available related to Data Security, Data Confidentiality, Secure Transmission of Data..etc. A SOC 2 compliance report?
    All data centers we host our servers have highest level compliance with security standards. Our primary platform is Google Cloud and it complies with; SSAE16 / ISAE 3402 Type II, SOC1, SOC2, SOC3, ISO 27001, ISO 27017 (Cloud Security), ISO 27018 (Cloud Privacy), PCI DSS v3.2 and HIPAA. You can find more information about Google Cloud compliance from https://cloud.google.com/security/compliance.

    Our secondary Platform is Amazon Web Services(AWS) and it complies with ;SOC1, SOC2, SOC3, ISO 27001, ISO 27017 (Cloud Security), ISO 27018 (Cloud Privacy), PCI DSS Level 1 and HIPAA. You can find more information about AWS compliance from https://aws.amazon .com/compliance/ If you need further information about security of our datacenters please fill in this request form.
  • Where is the datacenter? Do you have in-house servers?
    We use two different Cloud Platforms to host our servers. Our primary one is Google Cloud and its datacenter is located in Iowa, US. Secondary platform servers are hosted in Amazon Web Services (AWS) datacenters and they are located both in EU and US. The AWS EU datacenter is located in Frankfurt, Germany and the AWS US datacenter is located in Virginia, US. We do not have any in-house servers.
  • What is server failover?
    Our servers are managed by a High Availability policy and they are redundant within Google Cloud. They are also replicated in a second cloud platform (AWS) which makes switching to secondary platform possible within an hour without any data loss.
  • Are your systems tested for security flaws?
    Yes, our systems are regularly tested against external and internal threats.