Security & privacy
We can see the questions you ask — never the answers.
Answers and files are encrypted in the respondent's browser before they are sent. Only your Vault key opens them — we can't read them, reset the key or hand them over in readable form.
- End-to-end encrypted
- Hosted in Switzerland
- No trackers on forms
- Written for the nFADP
How it works
What happens to every response. It runs automatically for every form. Respondents install nothing.
- 01
Sealed on their device
On Submit, the browser encrypts the answers and files with a new key made for that one response. Only then is anything sent.
- 02
Stored sealed in Switzerland
Our servers keep the encrypted package and a locked copy of its key. Neither can be opened on the server.
- 03
Opened only by you
Your Vault key unlocks the response on your device. The key never leaves your browser, and we never see it.
Transparency
What we can and cannot see
Encryption covers what people send you. The form itself stays readable, because we have to show it to everyone who opens your link.
Encrypted — unreadable to us
End-to-end encrypted- Answers to every question
- Uploaded files, their original names and drawn signatures
- Unfinished answers saved to finish later
- Labels, notes and prefilled answers on personalised links
- Your Vault key and recovery code — they never reach us
No trackers on your forms
Form pages load no analytics, no advertising cookies and no third-party code. Fonts come from our own servers.
Readable by us — and why
Needed to run the service- Your account: email, name, plan, sign-in method and signed-in devicesto run your account and billing
- Your forms: titles, questions, settings (including unlock codes), translations, form profiles and tagsto show your form and run your dashboard
- Response metadata: when it arrived, its size, time to complete, questions answered, language, which personalised link was usedfor your inbox and insights — never the answers
- Counts: views, responses, device type; link opens only if you switch them onfor your insights, as totals
- Security records: IP address and browser on account sign-in events; respondents' IP addresses in short-lived rate-limit countersto stop abuse — removed after 90 days and within a day
- Emails we send you, and pseudonymous statistics on our own websiteto run and improve the service — emails deleted after 90 days
More detail, including how long each is kept, is in our privacy policy.
The Vault key
One key, and only you hold it
Signing in opens your account. Your Vault key opens your responses — a separate passphrase that never leaves your browser.
A trusted device can remember it, stored encrypted, and your vault locks itself after a period of inactivity you choose.
Your recovery code
Setting your Vault key gives you a one-time recovery code. With it, a forgotten key costs nothing: set a new one and keep all your data.
The Lost area
Lost both? A reset moves your forms and responses into a Lost area instead of deleting them. If the old key or code turns up, restore everything.
Why we can't reset it
A provider who can reset your key can also read your data. We can do neither — we hold nothing that unlocks it.
Hosting
Where your data lives
The application, database, file storage and AI features run with Infomaniak in Switzerland, under Swiss law.
Account protection
How your account is protected
Sign-in by code or password
Sign in with a one-time email code, or with a password if you set one. The code replaces the password; it is not a second factor.
Lockout and rate limits
Five wrong passwords or Vault keys pause further attempts for 15 minutes. Rate limits and automatic IP blocks shield your forms, without a third-party CAPTCHA.
Every session in view
See each signed-in device with its browser and system, and sign any of them out. Sessions store no IP address.
A vault that locks itself
After 24 hours without activity, your vault locks and that browser signs out. Choose 1, 2, 6 or 12 hours instead.
Checks on sensitive steps
Resetting your vault or deleting your account asks for your password or a fresh email code.
An internal security log
Sign-ins, exports and deletions are recorded in a log we use to investigate incidents. Its IP addresses are removed after 90 days.
Your data
Your data, and your way out
Export at any time
CSV, Excel, JSON, PDF and a ZIP with every file. Exports are decrypted in your browser.
Deletion
Deleting a response, form or workspace erases its encrypted data. Deleting your account deletes your forms, responses, files and profiles. QR-bill invoices are kept ten years, as Swiss law requires.
Automatic clean-up
Unfinished link drafts: 30 days. Sign-in codes: 10 minutes. Our email log: 90 days. Backups are overwritten within 30 days.
Compliance
Written for the nFADP and the GDPR
Under the nFADP and the GDPR you are the controller; we process data on your behalf. These documents set out our part.
Data Processing Agreement (DPA)
In force since 25 September 2026 · German, French, Italian, English
- Accepted with the Terms of Service; a countersigned copy on request
- Professional secrecy: we act as your auxiliary persons under Art. 321 SCC
- Notice of a data security breach within 48 hours
- 30 days' notice before any new sub-processor, with a right to object
- 90 days' notice and time to export if the service is ever discontinued
Privacy policy
What we process about you and your respondents, why, where and for how long.
What we don't claim
- ISO 27001 or SOC 2 certification
- An external audit or penetration test
- Multi-factor sign-in (MFA)
- Guaranteed uptime or recovery time
- A separate backup of response files — export regularly
- “Certified” nFADP or GDPR compliance
Our DPA lists the same limits. Found a weakness? Write to support@schweizerform.ch with the subject SECURITY.
Under the hood
Technical details
For your IT or security team. The encryption is only as strong as your Vault key — choose a long one.
Security FAQ
Questions a data protection officer asks
Check it yourself, on the Free plan.
Encryption is on for every form, from the first one. No credit card needed.