Concrete safeguards, without vague promises.

Access and environments

Creator data is protected by owner-scoped database policies. Production and staging use separate projects, credentials, and customer data. Public submission access is narrow and validated on the server.

Private file handling

Respondent attachments are stored privately, checked against allowed types and signatures, and quarantined until the configured malware scanner reports a clean result. Failed or unavailable scans remain closed to download.

Publishing and recovery

Draft and published content remain separate. Conflict-aware publishing prevents a stale editor from silently replacing a newer release. Email, Google Sheets, and webhook delivery provide visible state, bounded retry behavior, and manual recovery controls where supported.

Google data

Google Forms import uses a separate, read-only authorization for form definitions. Formfolk only retrieves forms whose links or IDs a creator provides; it does not list forms, read responses, transfer respondent uploads, modify source forms, or access Google Drive. The import connection uses online access only, stores no refresh token, expires within one hour, and can be disconnected at any time. Imported structure becomes an unpublished Formfolk draft.

Google Sheets uses a separate authorization to create and update a Formfolk-managed response spreadsheet.

Control and portability

Creators can export responses as CSV and delete responses or forms. Formfolk does not sell personal information or use form responses for advertising. See the privacy policy for subprocessors and retention information.

Questions and reports

Email hello@formfolk.app. Put “Security” in the subject line when reporting a potential security issue, and do not access anyone else’s data while investigating it.

Try it without committing

Build a draft before creating an account, or review current capabilities and limits.