How we protect your data
SendForm.live is a small, independent service. This page says plainly what we do to protect your forms and submissions — and what we don't claim.
Security features
HTTPS Everywhere
Data is encrypted in transit using TLS, with modern ciphers negotiated by Cloudflare. We enforce HTTPS on all connections with HSTS headers.
Cloudflare Edge Network
Built on Cloudflare Workers, your data is processed at the edge closest to your users for speed and security.
Spam Protection
Built-in Cloudflare Turnstile CAPTCHA and honeypot fields cut automated spam without annoying your users.
Encrypted Secrets
Webhook secrets are encrypted with AES-256-GCM before storage. Your API keys are never stored in plain text.
Rate Limiting
Per-IP rate limiting on submissions limits abuse of your forms, and Cloudflare's network absorbs volumetric attacks before they reach us.
Secure Authentication
Sign-in is handled by Clerk, a SOC 2-audited identity provider. Passwords and sessions never touch our code. (That is Clerk's audit, not ours — see Compliance below.)
Privacy by design
GDPR-Ready Privacy Notices
Add customizable privacy notices with consent checkboxes to any form. Include links to your privacy policy.
Automatic Data Retention
Submissions are automatically deleted after 30 days (Free) or 1 year (Pro). Your plan sets the retention period, and deletion runs daily.
IP Address Hashing
We hash IP addresses for spam prevention. We don't store raw IP addresses in submission records.
No Selling, No Ad Trackers
We don't sell data and there are no advertising trackers. The only analytics is Google Analytics, and it loads only after a visitor accepts the cookie banner — decline and nothing loads. Submission content is never sent to it.
Infrastructure
Built on Cloudflare
- Global edge network with 300+ locations
- DDoS protection included
- Automatic SSL/TLS certificates
- Web Application Firewall (WAF)
Security headers
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Content-Type-Options: nosniff
- X-Frame-Options protection
Compliance
SendForm.live holds no certifications of its own, and we won't show you a badge that implies otherwise. Here is what is actually true:
GDPR
We give you the tools — privacy notices with consent, automatic retention, export, and deletion on request. Whether a given form complies is up to how you use them.
CCPA
You can delete any submission, any form, or your whole account at any time, and we don't sell personal information.
SOC 2
Our providers are audited — Clerk (authentication) and Cloudflare (hosting and storage). SendForm.live itself has not been independently audited.
Seen a form that shouldn't exist?
Forms on sendform.live are built by our users, not by us. If one is collecting passwords, payment details, or impersonating a company, tell us — every hosted form has a "Report this form" link, or email support@sendform.live with the form link. We review every report and remove forms that break our terms.
Security researchers: the same address reaches the person who runs the service. Please give us a reasonable window to fix an issue before publishing it.
Ready to build secure forms?
Start collecting submissions with confidence. Your data is protected.