JotForm Secure Online Forms
At JotForm, our reputation rests on our ability to provide all of our users with the highest form security.
Why is JotForm Secure?
256 Bit SSL
Regardless of your plan, all your forms are served across protected 256 bit SSL (Secure Socket Layer) connection that uses a SHA256 Certificate. This is the same level of protection used by online banking or e-commerce providers. Read More
You can easily encrypt your forms to ensure that submission data is transferred and stored in a secure format and no one else can read it. Submissions are encrypted with high-grade RSA 2048 right at user's computer then transferred and stored in our servers securely. Read More
JotForm is PCI DSS Service Provider Level 1 compliant, the highest security attainment you can have as a business that collects payments from, and integrates with, credit cards. Read More
JotForm is fully compliant with the European Union’s General Data Protection Regulation (GDPR), the data protection law taking effect on May 25, 2018. This applies to any business that collects data in or from Europe. Read More
JotForm is compliant with the California Consumer Privacy Act (CCPA), which protects California residents by requiring businesses to handle their online and offline data in a responsible manner. Read More
Healthcare providers collect patient information through JotForm’s HIPAA-compliant forms. A Business Associate Agreement (BAA) is also available upon request. Read More
In addition to the Captcha’s that you can use in your forms, we have several other options to protect your forms from spammers. For example, you can choose to allow only one submission per IP or computer, or you can disable your form after a specific time or number of submissions. Read More
In privacy settings, you can limit access to your data depending on the level of privacy that you choose. You can also disable cloning of your forms or require a login to access a submission (this is by default protected via unique URLs).
How you can make your forms even safer?
There are several form security options for your data in JotForm. This makes it easy to choose the level of privacy and security that you want for your forms.
Make Your Forms Encrypted
You can easily encrypt your forms to ensure that submission data is transferred and stored in a secure format. JotForm uses the RSA-2048 algorithm while encrypting your form data. Since you own your encryption key, use caution storing it. If you lose your key, it is impossible to access your encrypted data anymore.
When you enable this feature and get a submission, notification emails sent by JotForm does not include any form submission data. You can learn more about how to encrypt your forms here.
File uploads are not covered within this feature. You can read about file upload security from this post.
Set Privacy of Your Forms and Data
Access to submissions of a form is protected and requires login to the account which owns that form. However, a single submission can be viewed if the unique, and almost impossible-to-guess URL of that single submission is known. If you think that you want additional privacy, you can add an extra layer of protection and require login in addition to the security provided by unique URL.
Since you have total ownership of your forms and submissions, access to your data is granted only with your permission when you use an integration widget and/or app. Rest assured that we treat your data with the utmost confidentiality.
Keep Your European User Data in Servers
You can select to store your data in the European Union (EU) from the Data tab in your account settings. After confirmation, your form data will be copied to our European servers in Frankfurt, Germany, run by Amazon Web Services. Once the transfer is complete, you’ll be automatically redirected to eu.jotform.com upon login. There’s no need to worry about the safety of your data. JotForm is fully compliant with the EU’s General Data Protection Regulation.
With JotForm Enterprise, you can use geolocalization to host form data on servers in almost any part of the world. Since many countries — including Australia — have laws requiring this, it can be an invaluable tool for global businesses.
Back Up Your Data
You can backup your data with a single click from the “Data” tab in your account settings. When you trigger a backup operation, we start preparing a single ZIP file that contains the HTML code for your forms, a CSV export of your form submissions, and any uploaded files.
These backups can either be downloaded or stored in our database. If you wish to take backup of your forms only, it is also possible to download their source code in zip format and store in your local storage from Publish options.
Keep Your Forms Safe From Spammers
JotForm offers two different CAPTCHA alternatives to make it difficult for bots to fill out your form, while still keeping it easy for people. You can either use a basic CAPTCHA or reCAPTCHA, as provided by Google.
We’ve also implemented multiple coding checks within the submission process to analyze if the submission is coming from a person. If spam does get through, our 24/7 support team will help identify the cause and credit your account, if necessary.
As an additional spam protection, you can also limit submissions to your form so that only one submission can be made from one IP address, or one computer. If you prefer, you can also enable both for greater protection. Furthermore, you may also choose for your forms to be disabled at a specific time or after a specific submission limit has been reached.
Service Level Agreements
JotForm has a near perfect uptime ratio of 99.9 percent, so you’ll always be able to access your data. You can check JotForm’s operational status in real time here. Our JotForm Enterprise service promises to meet the error response rates, resolution times, and uptime ratios outlined in your specific service level agreement (SLA). If these goals aren’t met, you will receive a partial refund as agreed upon in your signed Enterprise agreement.
What measures do we take to protect your data?
When it comes to form security, high availability or high performance, we go the extra mile all the time. We do our homework to keep our service secure.
JotForm servers are co-located in a cloud based architecture with Google Cloud and Amazon Web Services (AWS). Google Cloud data centers are hosted in Iowa (US). AWS data centers are located both in Germany, Frankfurt (EU) and US, Virginia (US).
Google Cloud servers host our redundant application and data servers in active-active configuration and all data is also replicated to AWS servers continuously. This provides a platform level redundancy in addition to the redundancy obtained with multiple servers within single platform. In case we need to switch from primary platform (Google Cloud) to the secondary platform (AWS), this architecture helps us for an easy and fast switch.
Hosting JotForm at these major cloud platforms also provides us some extra benefits in means of implementation of security best practices in areas like hardware lifecycle management, physical security and network infrastructure. Our servers are constantly updated and patched.
Dedicated Server Locations
If you’re a JotForm Enterprise user, you can choose the physical location of your dedicated cloud server and host your data in any part of the world — this is especially important for complying with data privacy rules and location requirements in places such as Australia, Canada, the U.K., and the EU. Whether you choose to keep your data server close to home or your audience, you’ll enjoy better security, reliability, and site latency. Only users and admins within your Enterprise account will be able access your data server.
Backup Policy / Business Continuity
We continuously replicate (backup in real time) your data between multiple servers hosted by our primary service provider Google Cloud. Additionally, all data is also replicated to AWS (our secondary platform) in real time. We take snapshots of our all data every hour. Each snapshot is stored for 30 days in the cloud environment.
Single Sign-On (SSO)
With a JotForm Enterprise account, you can use single sign-on. A third-party login boosts security while making it easier for your employees to work together to run your business. You can still decide on login methods, track users’ actions, and maintain control of your account’s security.
You can also SSO-protect internal-facing forms with JotForm Enterprise. Users will need to be authenticated before viewing your form. That way, when you collect sensitive employee data, you can ensure the person submitting the form is who they say they are.
Encouraging Best Coding Practices
In addition to implementing features that increase security, we maintain best practices on the backend to ensure your account remains secure. We monitor sessions to restrict access of your account appropriately, and have constructed JotForm in a way that every account is isolated.
We have put safeguards in place to detect common attacks, such as SQL injection and cross-site scripting. Most importantly, we actively review our code for potential security concerns (in addition to evaluating all user feedback) so that we can address any issues if they arise. Our privacy statement speaks to our level of commitment to ensuring your data is not misused.
All developed code is deployed to the production environment only after certain procedures including tests run on staging systems. Our continuous deployment system and development process allow us to rapidly update and patch our system whenever needed.
PCI scans are performed to detect any kind of vulnerability of the publicly available interfaces regularly. Each quarter internal and external ASV (Approved Scanning Vendor) tests are performed for PCI. In addition to these PCI scans, Pen-tests are performed periodically for JotForm.
We also have a Bug Bounty program where we pay outside parties for reporting vulnerabilities which ensures that we are the first to know about them. We fix all issues reported to our bug bounty program with highest priority in the shortest time.
We have an outside routing layer provided by CloudFlare that provides basic filtering to handle and manage any potential DDoS (denial of service) attacks. Security scans are performed periodically as described in the audits/VA/PT chapter. Our servers are configured to allow only the absolute minimum level of access needed to maintain them.
All unnecessary users, protocols, and ports are disabled and monitored. Our employees are able to access the servers only through a Virtual Private Network using a 2048-bit encrypted connection with private keys. In addition to 3rd-party security services, our experienced development operations team continuously monitors any suspicious behavior on the entire system.
All account information is automatically encrypted when transferred. Unless you share your username and password with others, only you have access to your forms and submissions. You may add multiple users to your account with JotForm Enterprise.
Customizable Security Options
No matter what industry you work in, JotForm wants to help create the perfect security controls for your needs. As an Enterprise user, you can easily request to enable, disable, or add specific security settings to your dedicated server! Contact our Enterprise team to learn more.