Security

• Ikiform is served over HTTPS. The website and dashboard tell browsers to always use HTTPS (HSTS).
• Webhooks are only sent to HTTPS addresses on the standard port.
• Dashboard pages can't be framed by other sites.

• Ikiform has no passwords. You sign in with a one-time email code, Google or GitHub.
• Email codes are stored hashed, expire after 10 minutes and allow a few wrong tries before you need a new one.
• Sign-in requests are rate limited.
• Sessions expire 30 days after your last activity. You can sign out of every session at once in Settings.
• Sign-in cookies are marked secure and HTTP-only.

• Every form, submission, key and webhook belongs to one workspace. Database queries are scoped to that workspace, so one customer can't read another's data.
• Workspaces have three roles: owner, admin and member. Only owners and admins can change forms, API keys, webhooks and members. Only owners can add other owners.
• Secret API keys have scopes, such as reading submissions or reading forms, and can be revoked at any time. Publishable keys can only submit to forms and can be restricted to your domains.
• We store a SHA-256 hash of each API key, never the key itself. We can't show a key again after you create it.
• Ikiform's operator only looks at submission content when you ask, when needed to stop abuse, or when the law requires it.

• Visitor IP addresses are hashed with a secret before they are stored. The original address isn't stored. The hash is used for rate limits and abuse checks and isn't shown in the dashboard, API or webhooks.
• Spam checks include a honeypot field, a signed render time, Cloudflare Turnstile and a content score.
• Each form has rate limits per sender and overall.
• Forms can be locked to your own domains.
• Ikiform doesn't accept file uploads.
• Submissions with fields that look like passwords, card numbers or other secrets are flagged, and those fields are left out of notification emails.

• Every webhook is signed using the Standard Webhooks format: an HMAC-SHA256 signature over the delivery ID, a timestamp and the body. Our SDK checks the signature and rejects old timestamps.
• Each endpoint has its own secret, made from 32 random bytes.
• Webhook secrets and custom Turnstile secrets are encrypted with AES-256-GCM before they are stored. The encryption key is kept outside the database, and each encrypted value is tied to the record it belongs to.
• Webhook addresses are checked when you save them and before every send. Ikiform won't send to private, internal or local network addresses.

Dodo Payments, our merchant of record, handles checkout and stores payment details. Card numbers never reach Ikiform. Dodo's billing webhooks are checked for a valid signature before Ikiform acts on them.

• You can delete submissions, forms, workspaces and your account yourself in the dashboard.
• Deleted forms and workspaces stop working right away. Their submissions and logs are permanently deleted, usually within minutes and always within 24 hours.
• Spam is deleted after 30 days, webhook attempt logs after 30 days and delivery records after 90 days.

The full list of retention periods is in the Privacy Policy.

• Only the operator has access to production systems.
• Production secrets, such as encryption and signing keys, are stored as Cloudflare Worker secrets, not in code.
• Every code change runs automated lint, type checks and tests.
• Failures in background jobs and an uptime monitor email the operator.

If a security incident affects your data, we'll tell workspace owners by email without undue delay, aiming for within 48 hours, explain what happened and what we're doing about it, and tell the authorities where the law requires.

If you find a security problem in Ikiform, email security@ikiform.com. Tell us what you found and how to reproduce it. We'll reply within 3 business days.

• Please give us a reasonable time to fix the problem before you share it.
• Only test against your own account and workspaces. Don't access other people's data, run denial-of-service tests or send spam.
• We won't take legal action against good-faith research that follows these rules.
• There is no paid bug bounty yet. We'll credit you if you want.

To report a form being used for phishing or spam, email abuse@ikiform.com instead.