Security

• Database: Supabase-hosted PostgreSQL, with pooled and direct connection modes, automated backups.
• Authentication: Supabase Auth (email/password + Google OAuth), a custom short-lived JWT for API routes.
• File storage: AWS S3, private by default — uploaded files are served only via short-lived signed URLs, never a permanent public link.
• All traffic, dashboard, builder, and public form pages, runs over HTTPS/TLS.

A form's owner has full access by default. You can add teammates as collaborators from a form's Team tab, with two permission levels:

• Editor, can change the form, view responses, and manage most settings
• Viewer, can see responses only
• Only the owner can delete a form, add or remove collaborators, or delete the account

Respondent-submitted files (resumes, ID uploads, photos) are visible only to a form's owner and its collaborators, never to other FormBharat users.

• CAPTCHA, a Cloudflare Turnstile field, verified server-side on every submission, not just client-side, so it can't be bypassed by skipping your page's JavaScript.
• Webhook signing, every webhook delivery includes an HMAC-SHA256 signature (X-Webhook-Signature) so your endpoint can verify a payload actually came from FormBharat.
• Rate limiting, OTP sends and other sensitive endpoints are rate-limited per IP/phone to slow down abuse.
• Content safety checks, AI-generated forms are screened before publishing, and a form that trips a content-safety check shows a persistent banner to its owner rather than silently blocking with no explanation.
• Aadhaar collection is blocked at the platform level, forms cannot be built to collect Aadhaar numbers, regardless of field type.
• DPDP consent field, the form builder has a one-click "Add a DPDP consent checkbox" quick-insert for India's Digital Personal Data Protection Act, 2023, a starting point you edit to fit your actual data use, not a substitute for your own legal review.

Form responses are stored as submitted, tied to the form they belong to. Deleting a form or an individual response also deletes any files it uploaded to S3, not just the database row. See our Privacy Policy for what we collect, why, and your rights to access, correct, or delete your data.

We'd rather tell you plainly than dress up a checkbox as a certification we don't hold:

• FormBharat is not HIPAA-certified. Don't use it to collect protected health information (PHI) that requires HIPAA compliance.
• We do not offer enterprise SSO (SAML/OIDC) yet. Team access today is the collaborator model described above.
• We do not offer a data residency guarantee (e.g. "your data never leaves India"). Infrastructure is provided by Supabase and AWS in the regions those providers operate.
• We have not undergone a third-party security audit or penetration test at this stage of the product.

If any of these are a hard requirement for you, FormBharat isn't the right fit yet, please don't take our word over your own compliance team's.