∙Security
How we protect your forms and data.
The safeguards that are built into Sahl/form today — and how to tell us if you find a problem.
Isolation between workspaces
Each workspace’s forms and responses live in their own database schema, separate from every other workspace’s.
Encryption
All traffic uses HTTPS, enforced with HSTS. Data is encrypted at rest by our database provider.
Application safeguards
A Content Security Policy limits what can run on our pages. Public form submissions are sanitised before they are stored. Public and AI endpoints are rate-limited, and form owners can turn on Cloudflare Turnstile to keep bots off public forms.
API keys and webhooks
Integration API keys are stored only as SHA-256 hashes and are limited to the scopes you grant. Outbound webhooks are signed with HMAC-SHA256, so your server can verify that a delivery really came from Sahl/form.
Service providers
We publish every sub-processor that handles customer data, what it does and what it sees.
- Sub-processor list
- View the list
Certifications
Sahl/form is not SOC 2 or ISO 27001 certified. If that changes, we will say so here.
Reporting a vulnerability
If you believe you have found a security issue, email us with a description and the steps to reproduce it. We will acknowledge your report and keep you updated while we investigate.
Please do not access or change other people’s data, degrade the service, or disclose the issue publicly before we have fixed it. We do not currently run a paid bug bounty.
- Security contact
- security@sahlform.com
11Ready when you are
Your next form starts here.
نموذجك التالي يبدأ من هنا.
14-day free trial. No credit card. Arabic and English, from the first keystroke.