Is it safe to trust a form backend with confidential data?
The honest answer: only if the backend minimizes what it collects, scopes who can read it, and deletes it on a schedule. Here is exactly how Form2Lead does all three — and what we refuse to claim.
Last updated:
TL;DR — should I trust Form2Lead with sensitive form data?
Yes — with eyes open. Form2Lead enforces HTTPS with TLS 1.3 on all submission endpoints, sets no cookies and runs no submitter analytics at ingestion, stores payloads as organization-scoped rows readable only via your authenticated dashboard, encrypts data at rest with AES-256 disk encryption (Neon managed Postgres), and hard-deletes expired submissions on a daily schedule. What we cannot claim matters too: no end-to-end encryption, no SOC 2/ISO certification.
Scope check: opaque endpoint IDs, organization-scoped dashboard reads, plan-defined auto-deletion.
What happens to your submission
Four stages, no hidden copies. Email only exists if you configure a notification address — otherwise the submission is dashboard/webhook-only.
- 1
Receive
HTTPS only — TLS 1.3 enforced on every submission endpoint. No cookies set, no submitter analytics run.
- 2
Validate
CORS origin check, invisible honeypot, and Upstash Redis IP rate-limit counters (never submission content).
- 3
Store encrypted
Organization-scoped rows in Neon Postgres with AES-256 disk encryption. Readable only via your authenticated dashboard.
- 4
Auto-delete
Hard-deleted by a daily janitor when your plan window expires (files first). Owner deletes hide immediately.
TLS 1.3 enforced, nothing extra collected
- HTTPS with TLS 1.3 enforced on all submission endpoints. Plain HTTP is not accepted for form payloads.
- Ingestion sets no cookies and runs no submitter analytics. The person filling out your form is not tracked, fingerprinted, or profiled.
- Rate limiting sees counters, not content. Upstash Redis stores IP rate-limit counters only — never submission content.
- Your email never appears in page HTML. Endpoint IDs are opaque random strings scoped to one form. Contrast: FormSubmit puts your@email.com in the form action, exposing the owner address to every visitor and scraper.
Encrypted, scoped, dashboard-only reads
- Neon managed Postgres with AES-256 disk encryption (public source: neon.com/docs/security/security-overview). Encryption keys are held by the infrastructure provider — stated honestly, because key custody matters.
- Payloads are stored as organization-scoped rows readable only via your authenticated dashboard. There is no public read path and no shared spreadsheet.
- No end-to-end / zero-knowledge encryption is claimed — anyone promising that for a dashboard-and-email product without proof deserves skepticism, including us if we ever said it.
Auto-deletion windows by plan
Every plan deletes — the window is what differs. Expired rows are hard-deleted by an automated daily janitor, with attached file objects deleted first. Derived from the public pricing catalog, so these numbers always match /pricing.
| Plan | Retention window | What happens at expiry |
|---|---|---|
| Free | 7 days (7 days) | Hard-deleted by daily janitor; file objects deleted first |
| Basic | 14 days (14 days) | Hard-deleted by daily janitor; file objects deleted first |
| Starter | 1 month (30 days) (30 days) | Hard-deleted by daily janitor; file objects deleted first |
| Growth | 4 months (120 days) (120 days) | Hard-deleted by daily janitor; file objects deleted first |
Email alerts are optional — not a second database
Email alerts are configured per form. Forms without a notification email are dashboard/webhook-only — no email copy ever exists. If you handle employment applications, medical intake, or financial details, leave email off and keep the payload in the scoped dashboard (plus CSV export whenever you need it).
Sub-processors, disclosed plainly
Our position: we don't sell data, run no ads, and train no AI on submissions. The vendors below are the only third parties that can touch form data or its metadata.
| Vendor | Role | Scope |
|---|---|---|
| Resend | Email delivery | Only when a form has a notification email configured |
| Neon | Postgres + object storage | Submission rows and attached file objects, AES-256 disk encryption |
| Upstash Redis | IP rate-limit counters | Counters only — never submission content |
| Cloudflare Turnstile | Bot verification | Account and support forms only — not submission ingestion |
| Razorpay | Billing | Checkout and subscription payments |
| PostHog | Product analytics | Our dashboard usage — not your form submitters |
What we refuse to claim
- No end-to-end / zero-knowledge encryption.
- No SOC 2 or ISO certification.
- No “never stored” story — storage is real, scoped, and time-boxed.
- No instant deletion from all backups — provider backups rotate on their schedule.
- No GDPR “certification” — GDPR-ready practices instead (scoped access, export, deletion).
How rivals handle this
- Formspree is reported SOC 2 Type II but US-only with no public sub-processor list (reported).
- Basin is reported to keep submissions up to 48 months and run Google ad trackers.
- Getform is reported to store data indefinitely until manual deletion, with vague encryption wording.
- Web3Forms is reported to retain up to 3 years and share IP + email with spam vendors.
- FormSubmit exposes the owner email in HTML and publishes no security page.
- Formcarry (EEA storage) and Formspark (EEA, honest minimal claims) are the strongest privacy rivals — a fair choice if EU residency is your top requirement.
Responsible disclosure
Found a vulnerability? Our standardized RFC 9116 policy lives at /.well-known/security.txt and reports go to security@form2lead.com. Please give us a reasonable window to fix before disclosing publicly.
Legal details — retention numbers, deletion, sub-processor summary, and DPA requests — are on the Privacy Policy. For DPA or deletion requests, contact us via /contact.
Security & privacy FAQ
Is it safe to send confidential data through a third-party form backend?
It depends on what the backend stores, who can read it, and how long it keeps it. Form2Lead minimizes each risk: TLS 1.3 in transit, organization-scoped rows readable only via your authenticated dashboard, AES-256 disk encryption at rest (Neon managed Postgres, keys held by the infrastructure provider), opaque random endpoint IDs with your email never in page HTML, and automatic hard-deletion when your plan retention window expires. Forms without a notification email are dashboard/webhook-only, so no email copy ever exists.
Do you use cookies or analytics on people filling out my forms?
No. Form submission ingestion sets no cookies and runs no submitter analytics. Rate limiting uses Upstash Redis IP counters only — never submission content. Product analytics (PostHog) covers our own dashboard usage, not your form submitters.
Where is submission data stored, and who can read it?
Payloads are stored as organization-scoped rows in Neon managed Postgres with AES-256 disk encryption (see https://neon.com/docs/security/security-overview); encryption keys are held by the infrastructure provider. Rows are readable only via your authenticated dashboard. Endpoint IDs are opaque random strings, and the owner email never appears in page HTML — unlike FormSubmit, which puts your@email.com in the form action.
How long do you keep submissions?
Retention is plan-defined and automatic: Free 7 days, Basic 14 days, Starter 30 days (1 month), Growth 120 days (4 months). Expired rows are hard-deleted by an automated daily janitor, with attached file objects deleted first. Provider backups rotate on their own schedule — we do not claim instant deletion from all backups.
What happens when I delete a submission?
Owner delete in the dashboard hides the submission immediately — it disappears from the inbox, counts, and CSV export — and it is permanently purged along with its files within 30 days.
Do I have to receive submissions by email?
No. Email alerts are optional per form. A form with no notification email configured is dashboard/webhook-only, so no email copy of the submission ever exists. CSV export is self-serve on every plan, including the $0 Free plan (400 submissions/mo, 50 email alerts, 7-day retention).
Who else touches my form data (sub-processors)?
We disclose sub-processors plainly: Resend (email delivery, only when a form has email configured), Neon (Postgres and object storage), Upstash Redis (IP rate-limit counters only — never submission content), Cloudflare Turnstile (bot verification on account and support forms only), Razorpay (billing), and PostHog (product analytics). We do not sell data, run no ads, and train no AI on submissions.
Are you SOC 2 certified / GDPR certified / end-to-end encrypted?
No — and you should distrust any form backend that claims these without evidence. Form2Lead does not claim end-to-end or zero-knowledge encryption, SOC 2/ISO certification, or GDPR certification. We follow GDPR-ready practices (scoped access, export, deletion, data-minimizing retention), publish an RFC 9116 security contact at /.well-known/security.txt, and accept reports at security@form2lead.com.
Keep researching
Test the trust claims yourself
Free plan: 400 submissions/mo, opaque endpoint, dashboard-only reads, 7-day auto-deletion, CSV export included. No card required.