Blog

Articles on forms, data protection and encryption.

Practical articles on collecting personal data safely: end-to-end encryption, the nFADP and choosing a form tool.

Why Encryption Matters for Form Data

Your form data is only as safe as the server that holds it. Here's why end-to-end encryption is the only real answer — and what zero-knowledge means in practice.

nFADP Compliance for Online Forms

Switzerland's new Federal Act on Data Protection has been in force since September 2023. Here's what every business running online forms needs to know — in plain language.

Zero-Knowledge Architecture Explained

The phrase 'we cannot see your data' sounds like marketing — until you understand the cryptography behind it. Here's exactly how zero-knowledge works, step by step.

Encryption at Rest vs End-to-End

Most form tools advertise encryption without clarifying what they actually mean. Here's the difference between at-rest and end-to-end — and why it matters to your bottom line.

The Hidden Cost of "Free" Form Tools

If you're not paying for the form tool, your data often is. A clear-eyed look at how "free" platforms actually make money — and what that means for the people filling out your forms.

Swiss Data Sovereignty

The jurisdiction where your form data lives shapes who can demand it, who can read it, and under which laws. Here's why Switzerland is often the right answer.

GDPR vs nFADP: Form-Data Guide for Swiss Businesses

Swiss businesses processing EU resident data face two regimes at once. Here is a field-level comparison focused specifically on what it means for online forms.

Why HTTPS Alone Is Not Enough

HTTPS protects data in transit, not data at rest and not from your form vendor. Here is what that means in practice — and where end-to-end encryption actually matters.

Breach Notification: How Encryption Changes the Equation

The 72-hour clock is brutal. The encryption exception under Art. 34 GDPR — and its functional equivalent under the nFADP — can shrink it. Here is how, in practice.

Subpoenas & Warrants: What Happens to Your Form Data

An order lands on your form vendor's desk. What actually leaves the door — and what the vendor's architecture does to that question.

Form Data Retention — How Long Should You Really Keep Submissions?

Practical retention periods for form submissions — how to set them, document them, and avoid the silent risk of indefinite storage. GDPR, nFADP, and sector-specific guidance.

7 Red Flags Your Form Builder Is Mishandling Your Data

Seven specific warning signs that a form tool is quietly mishandling your data — what to check, why it matters, and how to read between the lines on a security page.

The Complete Guide to Secure File Uploads Through Online Forms

Medical certificates, ID scans, contracts — files are the riskiest part of any form. What makes a file upload genuinely secure, what most tools miss, and where zero-knowledge changes the equation.

Informed Consent in the Digital Age

Consent is not a checkbox. Capacity, voluntariness, information, comprehension — what informed consent actually requires online, where most forms fail, and how to design one that holds up to scrutiny.

HIPAA-Compliant Form Collection

What HIPAA really requires from online forms — Privacy Rule, Security Rule, BAAs, encryption, audit logs — and where most "HIPAA-compliant" form claims start to leak.

Anonymous vs Pseudonymous Forms: When Each One Matters

Most 'anonymous' forms aren't. The distinction between true anonymity and pseudonymity changes what regulators see, what attackers can extract, and which use case the form actually fits.

Is Google Forms Secure?

Google Forms uses TLS and encryption at rest — but Google holds the keys, so it is not end-to-end encrypted. Here is who can actually read your responses, and when that matters.

nFADP vs GDPR: Key Provisions Compared

A pillar comparison of the nFADP and the GDPR, provision by provision — including the automated-decision and AI rules that increasingly shape how forms collect data.

EU Whistleblowing Directive: Compliant Multilingual Reporting Channels

What Directive (EU) 2019/1937 actually requires of an internal reporting channel — confidentiality, the 7-day and 3-month deadlines, the multilingual reality, the Swiss angle, and why E2EE matters for reporter trust.

Is Microsoft Forms Encrypted?

Microsoft Forms encrypts data in transit and at rest — a solid baseline. But it is not end-to-end encrypted: Microsoft and your tenant admins can read responses. Here is what that means for security and compliance.

Encrypted Form Platforms for Finance & Healthcare

Finance and healthcare collect the most sensitive data there is. This guide explains what 'encrypted' actually means, how to evaluate a form platform honestly, and where zero-knowledge end-to-end encryption fits.

Best Online Form Tools for Swiss Companies

A fair, honest roundup of the leading online form tools — measured against what Swiss companies actually need: nFADP alignment, Swiss data residency, DE/FR/IT/EN forms, and the right encryption model for the data you collect.

Which Form Data Can Legally Leave Switzerland?

There is no rule that Swiss form data must stay in Switzerland. There is a test — adequacy, safeguards, derogations — plus three sector overlays that beat the answer. Here is how to work through it and document it.

Can I Use Google Forms Legally in Switzerland?

No Swiss law bans Google Forms and none requires Swiss servers. What the law requires is a processor contract, a lawful transfer basis and a privacy notice — plus secrecy duties that override all of it. Here is the decision tree.

Do You Need a Data Processing Agreement for Your Form Tool?

Yes, you need one — and no, it does not stop the provider reading your submissions. A practical guide to Art. 9 nFADP and Art. 28 GDPR for form tools, with a checklist and an honest list of what a DPA cannot do.

nFADP Compliance Checklist for Forms & Surveys

An operational audit checklist, not another explainer. Thirteen items, the nFADP article behind each, and the specific document a reviewer will ask you to produce for it.

Anonymous Employee Surveys: How Many Responses Before Anonymity Holds?

Five is the convention, ten is safer, and neither saves you if you publish three demographic filters on a twelve-person team. The concrete answer nobody in the Swiss market gives.

How to Create a Secure Online Form: A Practical Guide

Nine decisions turn a form into a secure form — and most of them are made before you add the first question. The full lifecycle, from field minimisation to deletion evidence.

Which Form Tools Are Hosted in Switzerland — and Why It Matters

A `.ch` domain is not a hosting claim, and a Swiss data centre is not a confidentiality claim. The three questions to ask, and the six side channels that leak data out of Switzerland anyway.

Preventing Spam, Bots and Duplicate Submissions Without Breaking Anonymity

You cannot enforce «one response per person» without knowing something about the person. Here is how to spend the least identity possible — and what to do when the answer must stay anonymous.

Data Protection in Clinical Research: nFADP, HRA and GCP for Electronic Forms

Coded is not anonymous, an eCRF is a regulated computerised system, and sponsors need auditor access. The legal explainer our vertical page does not give you.

Collecting Health Data in Forms: What «Sensitive Data» Actually Requires

The allergy question, the accessibility box and the free-text field are how most organisations end up holding health data without deciding to. What that costs, and how to stop.

Is Microsoft Forms Compliant with Swiss Data Protection Law?

The EU Data Boundary is real and it is not Swiss. Where Microsoft Forms is lawful in Switzerland, where it is not, and the four Swiss-specific facts most tenants get wrong.

Is Typeform Compliant for Swiss Businesses?

An EU company on US infrastructure, with regional hosting as a paid tier. Lawful for marketing, wrong for confidential intake — and the reasons are not the ones usually given.

Can Schools Use Google Forms? Data Protection for Swiss Schools

Cantonal law decides, not federal law — and the answer changes with the field, not the tool. Who consents for a pupil, why photo permission is its own problem, and what to use instead.

Whistleblowing in Switzerland — What the Law Actually Requires

No Swiss whistleblower law — and that is the answer most searchers are trying to confirm. The cascade, the six-month cap, Art. 22a Federal Personnel Act, and when Brussels binds you anyway.

Can I Collect IP Addresses? What Your Form Silently Records

An IP is personal data, not contraband. The real problem is the metadata nobody chose to collect — and the inventory almost no vendor publishes. Here is ours.

Can You Leave? Data Export, Portability and Permanent Deletion

Portability rights belong to your respondents; your exit is contractual. What a real export contains, what dies in migration, and what «deleted» has to mean.

AI Form Builders — What They Do, and What They Do With Your Data

Four different features share one label. Only two of them put respondent answers in front of a model — and nobody tells you which one you bought.

Form Analytics Without Tracking — Completion Rates, Drop-Off and Privacy

Every metric worth having is an aggregate. Aggregates don't need visitor tracking — and a form with no cookie dialog in front of question one converts better.

Professional Secrecy and Online Forms in Switzerland (Art. 321 SCC)

A duty that sits on top of the nFADP and carries a prison sentence. It binds auxiliary persons — so the question is whether your form tool is one, and that answer is genuinely contested.

Digital Form Management — From Paper Trays to a Form Server

One form is a design problem. Two hundred forms is an inventory, a version-control and an archiving problem — and nobody in the organisation currently owns it.

What a Good Contact Form Looks Like — Design, Fields and Privacy

Five fields, no consent checkbox, no CAPTCHA, and a reply within two days. Most of what goes wrong on a contact form is added on purpose.

Put it into practice.

Create a free account and publish your first form in minutes. Answers are end-to-end encrypted on every plan.

Start for free How security works