The safest place for your data is your systems — not ours.

The foundation of our approach to security: we don't keep form submission data. Submissions are held temporarily during validation, workflow and delivery, then permanently deleted subject to your configured Data Retention Period — the default is 10 days.

Documented architecture and data flows. Data minimisation limits what's at risk to in-flight submissions.

Encryption in transit and at rest, WAF, mandatory MFA and least-privilege access, and a secure development lifecycle.

24/7 external monitoring, telemetry and alerting, weekly vulnerability scanning, and malware scanning of uploads.

Documented incident response plan with severity classification and client notification within 12 hours of a confirmed incident.

Geo-redundant infrastructure, documented recovery runbooks and objectives, and post-incident reviews that feed back into controls.

All connections to our website, API and forms use HTTPS with TLS 1.2. Form data is encrypted with AES-256 while temporarily held, and delivered to all services over HTTPS.

User passwords and access tokens for third-party services are encrypted with AES-256.

Portal access requires a FormsByAir login with mandatory two-factor authentication — trusted browsers are remembered for 30 days — or single sign-on with Microsoft Entra ID under your own identity and MFA policy. IP allow-listing is available per account, repeated failed logins lock the account, and API access uses revocable bearer tokens that expire automatically after 3 years.

Our staff see metadata only by default — access to form data must be requested per issue and is logged. Production infrastructure is administered under least-privilege access with multi-factor authentication, and access is audited.

All traffic enters through Azure Front Door — a global edge network with a Web Application Firewall running Microsoft's latest managed rule set, with bot protection. Rule updates run in monitoring mode against live traffic and are tuned before they are enforced.

DDoS attacks are absorbed at the edge, before they reach the application, with selective blocking of attacking traffic.

FormsByAir is hosted on Microsoft Azure. Encrypted form data is held, while in flight, in a dedicated storage account in your account's document region — Australia East (the default), UK South or West US — and the region is shown on your account's Profile page.

Supporting services include GoDaddy (domains/SSL), SendGrid and SMTP2GO (email), Pingdom and Atlassian (monitoring), and ClamAV (malware detection).

Infrastructure follows Azure best practice for high availability including global CDN endpoints. Production is monitored 24/7, every minute, from multiple geographic locations.

We target at least 99.95% availability every month. A public status page is available at status.formsbyair.com.

Independent web application penetration testing using OWASP Top 10 methodology, including authenticated testing and remediation retesting. Weekly external vulnerability scanning with Intruder. Reports available on request.

Our HTTPS configuration is independently rated A+.

Every production change is code reviewed. We build on modern frameworks with protections built in — server-side validation, anti-forgery controls and secure session handling — following OWASP guidance, with dependencies updated regularly.

Post-deployment integrity checks — automated API and browser smoke tests — verify behaviour after every release, and a public changelog is available at docs.formsbyair.com/changelog.

A documented cyber incident response plan covers identification, containment, eradication, recovery and post-incident review, with defined severity classifications.

Affected clients are notified within 12 hours of a confirmed incident via status.formsbyair.com and direct email, followed by a detailed post-mortem.

All components are configured with regional and geo redundancy, including database geo-replication with point-in-time restore. Recovery procedures are documented in step-by-step runbooks with defined recovery objectives.

Our business continuity plan has no dependency on any physical office, and external service outages degrade gracefully — submissions continue and integrations resume without data loss.

FormsByAir is compliant with data-processor obligations under GDPR and UK GDPR. For UK accounts, form data is temporarily held and processed in the UK. A current list of sub-processors is available on request.

FormsByAir is not PCI-compliant and does not store or transfer credit card information — payments are handled by PCI-compliant gateways.

We monitor for unusual patterns of activity against your forms and block access if thresholds are exceeded.

All form attachments are scanned for malware immediately after submission. Infected files are quarantined and account administrators are automatically notified.

AI assists our team with form configuration — converting, checking and testing form definitions. It is never given form submission data: submissions are processed by the platform alone, and staff access to form data remains per-issue and logged.

You can connect Claude to your own account through our hosted MCP connector. It signs in with your FormsByAir login using OAuth 2.1 and is confined to form configuration — it cannot read submitted documents, publish forms or change account settings, and production forms change only through the same versioned deploy the portal uses. Access tokens last one hour, refresh tokens rotate on every use, every change is attributed to the connection in the form's version history, and a connection can be revoked at any time. See docs.formsbyair.com/claude/connector.