We can't read your data. By design.
Every response to your forms is encrypted in the respondent's browser — before it travels, before we store it. What reaches our Swiss servers is a sealed package that only your Vault key can open.
We can see the questions you ask — never the answers people give.
Your form itself — its title, questions and settings — must be readable so we can show it to anyone who opens your link. The answers people type, the files they upload, the signatures they draw: those are encrypted on their device and stay unreadable to us, permanently.
Any form service that shows a public form works this way, whether they say so or not. We prefer to say so — because a privacy promise is only worth something when you know exactly where it runs.
Three steps. No exceptions.
This happens automatically for every single response — respondents don't install anything, and you don't configure anything.
Sealed on their device
The moment someone presses "Submit", their browser locks all answers and files with a unique key created just for that one response. Only then does anything leave their device.
Stored sealed in Switzerland
Our servers receive and store the sealed package — never the content. The connection itself is encrypted too, and the package stays encrypted at rest on Swiss infrastructure.
Opened only by you
When you open a response, it's decrypted inside your browser using your personal Vault key — a key that never leaves your device and that we never see. No Vault key, no access. For anyone.
What we can — and cannot — see.
Never visible to us
Visible to us — and why
That's the complete list. We publish it because "everything is encrypted" is a slogan — this table is a commitment.
One key. Yours.
Alongside your password, you choose a Vault key — a separate passphrase that unlocks your responses. It never leaves your browser. That single fact is why nobody — including us — can read your data.
You'll be asked for your Vault key when you open responses. On your own devices you can choose to remember it — stored encrypted, never as plain text — and your vault locks itself again after a period of inactivity that you control.
Your recovery code
When you set your Vault key, you receive a one-time recovery code. Store it like you'd store a backup key to your office — with it, a forgotten Vault key costs you nothing.
No silent data loss
Forgot both? Your existing forms and responses are set aside in a protected area — not deleted. Recover them anytime later with the old Vault key or recovery code, while you keep working with a fresh vault.
Why we can't reset it for you
A provider who can "reset" your encryption key can also read your data. We can't do either. That's not a support limitation — it's the proof the promise is real.
Swiss infrastructure, not just a Swiss name.
Schweizerform runs on infrastructure operated in Switzerland by Infomaniak — one of Switzerland's most respected hosting providers.
One service in our stack is not Swiss: payments. Subscriptions are processed by Stripe, a specialist payment provider — your card details go directly to Stripe and never touch our servers, and Stripe never sees your forms or your respondents' data. We name this exception because "100% Swiss" would be a better slogan, but a worse truth.
Schweizerform is operated by a Swiss company under Swiss law. Your account is subject to Swiss data protection — not a foreign cloud provider's terms.
Nobody is watching. Not even us.
Most "free" form tools are paid for with data. Schweizerform is paid for with subscriptions — CHF, not surveillance. It shows:
Protection you'll actually notice.
Passwords, handled properly
Stored only as strong one-way hashes. We couldn't tell you your password if you asked.
One-time codes for sensitive steps
Signing up, changing your password or resetting your vault requires a fresh code sent to your e-mail.
Every session in view
See each device that's signed in and sign any of them out remotely.
Automatic lockout
Repeated failed logins lock the account before guessing gets anywhere.
A vault that locks itself
Your decrypted view closes after inactivity — you choose how quickly, from 1 hour to a day.
Quiet abuse protection
Rate limits and automatic blocking shield your public forms from bots and floods — without third-party CAPTCHA services.
You stay in control — including the exit.
Take everything with you
Export your responses anytime — CSV, Excel, PDF or a full ZIP archive with every file. Exports are generated in your browser, so your data is decrypted only on your machine.
Deletion that means it
Delete a form, a workspace or your whole account, and the encrypted data is erased from our storage — not flagged, not archived, erased. Cancelling your subscription never deletes anything by itself.
A trail you can rely on
Security-relevant actions — sign-ins, exports, deletions — are recorded in an audit trail, so "who did what, when?" always has an answer.
Designed for the nFADP and the GDPR.
Swiss businesses answer to the revised Swiss Data Protection Act (nFADP) — and often to the GDPR too. Schweizerform is built so the tool is never your weak point.
Data stays in Switzerland
Your form data is processed and stored on Swiss infrastructure — a straightforward answer to the first question every privacy-conscious client asks.
Encryption changes the breach equation
Because responses are end-to-end encrypted, a server-side breach would expose sealed packages — not personal data in the clear.
Erasure and portability, built in
Export anytime; deletion genuinely erases. The rights your respondents have are actions you can actually perform.
Clear roles
You remain in control of what you collect (controller); Schweizerform processes it on your instructions (processor), on Swiss infrastructure.
Data protection compliance always depends on how you use any tool — Schweizerform gives you the technical foundation, not a legal rubber stamp. Questions? Our support speaks nFADP.
What we don't claim.
You won't find ISO or SOC 2 badges on this page — we haven't completed those audits, so we don't display their logos. If that changes, you'll read it here first.
You won't find "100% secure" or "military-grade" either. Nobody serious says that. Security is architecture plus habits: we deliver encryption that removes us from your trust equation — and you keep your Vault key strong and your recovery code safe.
What we do claim, we can show: end-to-end encryption of every response, Swiss infrastructure, no trackers, no data trade. If you have a question our pages don't answer — or you believe you've found a weakness — contact us. Skeptical readers made this product better more than once.
The hard questions, answered plainly.
Privacy that works out of the box.
No configuration, no consultants — encryption is on for every form, from the first one. Free plan, no credit card.