Start free

Security at PulseFormCreator

Last updated: 23 September 2026

PulseFormCreator stores the forms you build and the answers people send you. Here is how we protect them.

1. Encryption

Every page, form and API request is served over HTTPS, and browsers are told to use nothing else for this site (HSTS). Stored data is encrypted at rest by our providers: the database that holds forms and responses (Supabase) and the storage for uploaded files (Cloudflare R2).

2. Who can see your data

Each account's forms and responses are kept separate in the database with row-level security. A form's responses are visible to its owner. On Pro and Business, teammates can see them too if their role allows it: admins, editors and viewers see responses, and builders can edit a form without seeing any.

Uploaded files and signatures are not public. They open for the same people, or through a short-lived signed link, such as the one in a notification email.

3. Sign-in

You sign in with a one-time code that we email to you, and you type it into the page. The email has no sign-in link, so a mail scanner that opens links can't use the code up. A code works once, for one hour. There are no passwords, and there is no Google or other social sign-in. There is no separate two-factor sign-in (2FA): your email inbox is what protects your account, so keep it secure.

4. API keys, form passwords and IP addresses

  • API keys are shown once, when you create them. We store only a SHA-256 hash of each key, so we can't show a key again or read it from our database. A key is read-only or read-and-write, and each key can make 100 requests a minute.
  • Form passwords are stored as scrypt hashes, never as plain text.
  • Respondents' raw IP addresses are not stored with their responses. We keep a keyed, one-way hash of the IP address and browser, used to spot abuse and duplicate responses. When a form has anonymous responses turned on, not even the hash is stored, and neither are the respondent's browser or device details.

5. Hosting and storage

The website and app run on Vercel. Forms and responses are stored in a Supabase database, and uploaded files in Cloudflare R2. Some of this data is stored or processed outside Australia. Section 8 of the privacy policy explains how we handle that.

6. Other safeguards

  • Sign-in pages and the dashboard can't be embedded in other websites, which blocks clickjacking.
  • CSV and Excel exports are protected against spreadsheet formula injection.

7. Third-party processors

We use Supabase (database and sign-in), Vercel (hosting), Cloudflare (file storage in R2, and the anti-bot check on forms whose owner turns it on), SendGrid (the email we send, and replies to it), OpenAI (the AI features; the AI data policy lists what each one sends and when it runs) and Stripe (billing for paid plans). When you connect another service to a form yourself, such as Slack, Google Sheets, Notion, Airtable or a webhook, responses go there because you set it up.

8. Responsible disclosure

If you believe you've found a security issue, please report it through the security disclosure form on our contact page. We aim to acknowledge reports within 5 business days. We will not pursue legal action against good-faith researchers who follow standard responsible-disclosure practice.

9. Certifications

PulseFormCreator is not SOC 2, ISO 27001, HIPAA or PCI DSS certified. If your use case requires one of those certifications, PulseFormCreator is not the right product for it. We also don't offer two-factor sign-in (2FA) or a standard data processing agreement (DPA).