# Security & privacy

> How Formclick protects your submissions, files and email delivery.

Source: https://docs.formclick.io/html-forms/security

- **HTTPS everywhere.** The endpoint, the script and file uploads only use encrypted connections.
- **Public access key, private data.** The key can create submissions but cannot read them. See [Access key](https://docs.formclick.io/html-forms/access-key).
- **Recipients come from your dashboard only.** A form cannot choose who receives the notification, so it cannot be turned into a spam relay.
- **Safe email headers.** `subject` and `from_name` are cleaned to a single line and length-limited. The sending address is always Formclick’s; the visitor’s email is only used as Reply-To.
- **Direct file uploads.** Files go straight to secure storage through one-time upload URLs and are linked in your submission.
- **Redirect checks.** Redirect URLs must be absolute `http(s)` links, and Free plans can only redirect within the same site.
- **Captcha verification (paid plans).** [reCAPTCHA](https://docs.formclick.io/html-forms/recaptcha) and [Turnstile](https://docs.formclick.io/html-forms/turnstile) tokens are checked with Google or Cloudflare on the server; captcha secret keys are stored encrypted.
- **Domain restriction.** [Restrict a form](https://docs.formclick.io/html-forms/restrict-domain) to your own websites on paid plans.
- **Disable any time.** Turn a form off in the dashboard and new submissions are refused with `403`.

## What is stored

For each submission Formclick stores the fields you sent (minus control fields such as `access_key`, `botcheck` and `redirect`), the submission time, the referring page, the IP address and browser user agent. The IP is used for rate limiting and abuse prevention.