Security & privacy

• HTTPS everywhere. The endpoint, the script and file uploads only use encrypted connections.
• Public access key, private data. The key can create submissions but cannot read them. See Access key.
• Recipients come from your dashboard only. A form cannot choose who receives the notification, so it cannot be turned into a spam relay.
• Safe email headers. subject and from_name are cleaned to a single line and length-limited. The sending address is always Formclick’s; the visitor’s email is only used as Reply-To.
• Direct file uploads. Files go straight to secure storage through one-time upload URLs and are linked in your submission.
• Redirect checks. Redirect URLs must be absolute http(s) links, and Free plans can only redirect within the same site.
• Captcha verification (paid plans). reCAPTCHA and Turnstile tokens are checked with Google or Cloudflare on the server; captcha secret keys are stored encrypted.
• Domain restriction. Restrict a form to your own websites on paid plans.
• Disable any time. Turn a form off in the dashboard and new submissions are refused with 403.

What is stored

For each submission Formclick stores the fields you sent (minus control fields such as access_key, botcheck and redirect), the submission time, the referring page, the IP address and browser user agent. The IP is used for rate limiting and abuse prevention.