Formwire
Infrastructure
Formwire runs on Cloudflare. The submit endpoint, the dashboard, the API and the MCP server are one Worker that runs at the Cloudflare location nearest the visitor. Submissions, forms and accounts are stored in Cloudflare D1 (SQLite). File uploads are virus-scanned and stored in Cloudflare R2. Email and webhooks run off the request path through Cloudflare Queues, so a slow downstream never slows a form.
The service is split across hosts on purpose. Visitors post to formwire.io, which serves nothing else and never receives a
dashboard cookie. You sign in at app.formwire.com. If a spammer ever gets the submit domain blocklisted, the dashboard and
this site stay up.
We have no servers of our own to patch. Cloudflare and AWS manage the physical hosts, networks and hypervisors, and both publish their own certifications (Cloudflare: SOC 2 Type II, ISO 27001; AWS: SOC 1, 2 and 3, ISO 27001).
Data and retention
Account data (users, workspaces, forms, API keys, usage counters and the audit log) lives in one global database in Cloudflare's US region. Submission content lives in a separate per-region database. You choose the region when you create a workspace: the US, or the EU, where a workspace's submissions, files and their nightly backups are stored in an EU-only database and buckets. Submissions never move between regions. Notification email is sent through Amazon SES in the US for every workspace. Workers still process a request at the Cloudflare location nearest the visitor.
Submissions are kept for the retention window set on each form: 30 days for a new form, and up to 365 days if you raise it in the form's settings.
A daily job purges anything older. You can shorten the window at any time, delete single submissions, clear a form, clear a workspace or delete the account yourself. Deleted submissions and forms sit in a trash for 30 days so a mistaken bulk action can be undone, then they are removed for good. Spam is kept for 30 days whatever the plan, so the spam folder works without filling the database.
The audit log records who did what (a form was created, a key was revoked) and never contains submission content. Queue messages carry IDs only, never field values.
Encryption
Every endpoint is HTTPS only, with TLS 1.2 or newer. D1 databases, R2 buckets and the backup buckets are encrypted at rest by the provider. Secrets we have to be able to use again, such as webhook signing secrets, are stored encrypted and are never returned by the API. Secrets we only have to check, such as API keys, are stored as hashes.
Access control and keys
Formwire has two kinds of key, and the difference matters:
- Access keys identify a form. They are designed to be public and sit in your HTML. They can only create submissions. Abuse is limited by the honeypot, rate limits, captcha and the form's domain restriction, and you can rotate one from the dashboard.
- API keys are secret. Each is limited to the workspaces and the operations you choose (for example read submissions only), is shown once when created, and is stored as a hash. Revoking a key takes effect immediately.
You sign in with a code sent to your email, a password, a passkey, or your Google or GitHub account. Sign-in is rate limited and checked with Cloudflare
Turnstile. Sessions are HttpOnly cookies scoped to app.formwire.com. Organizations have owner, admin and member
roles, and members only see the workspaces they were added to.
Our own staff access to production data is limited to the platform admin tools, which are audit-logged with the admin as the actor. We look at a customer's submissions only to resolve a support request from that customer or an abuse report.
Notification emails and confirmation emails to visitors are sent from notify.formwire.io through Amazon SES in the US (us-east-1).
Account email (sign-in codes, invites, alerts) is sent from accounts.formwire.com through Resend. Both domains have SPF,
DKIM and DMARC, and they are kept apart, so a bad day for submission mail cannot touch your sign-in codes.
Hard bounces and complaints come straight back to us and suppress the address automatically. If an address linked to your workspace stops receiving mail, the owners get one email saying so, with a link to fix it.
Spam and abuse
Every form gets a hidden honeypot field, spam scoring and per-IP and per-key rate limits. You can add hCaptcha, Turnstile or reCAPTCHA, block words and restrict a form to your own domains. Spam goes to the spam folder without being emailed. Over your plan's monthly quota, submissions keep arriving and you get an alert; a ceiling well above the quota stops runaway traffic.
Every notification email carries a "Report abuse" link. Reports go to a person. We can switch off a single form or a whole workspace immediately while we look, and we do, under the acceptable use policy.
Backups and continuity
Every database is exported nightly to a private R2 bucket; the EU database's exports go to one in the EU. D1 also keeps point-in-time history for 30 days. Nightly exports are kept for 30 days and the first of each month for a year. The whole service is defined in code and can be redeployed from the repository.
An uptime service checks every host around the clock, and each host's health check is on the status page.
Vulnerability reporting
If you find a security problem, email support@formwire.com with "Security" in the subject and the steps to reproduce it. A person reads every report, keeps you informed while we fix it and credits you if you want. Please give us a reasonable time to fix before publishing, and do not test against other customers' forms or data. We do not run a paid bounty programme.
Compliance
- Certified infrastructure. Formwire runs on Cloudflare and AWS, whose SOC 2 Type II and ISO 27001 certifications cover the data centres, storage and mail systems your submissions pass through.
- GDPR. We act as a processor for your submissions. Our data processing agreement incorporates the standard contractual clauses for transfers, and the subprocessor list says who else touches the data.
- CCPA. We are a service provider for your submission data and do not sell personal information. See the privacy policy.
Questions a security questionnaire does not cover? Email support@formwire.com and a person who works on the code will answer.