FormsFort
EN ES

DPA Readiness

Data Processing Agreement readiness.

FormsFort implements the technical and organizational measures required for a Data Processing Agreement. This page documents what is in place, maps controls to GDPR requirements, and explains how to request a signed DPA.

GDPR readiness

Requirement Status Details
Article 28 – Processor Ready for DPA FormsFort acts as a data processor for form owners (data controllers). A signed DPA establishes the formal processor relationship.
Article 30 – Records of processing Implemented FormsFort maintains records of processing activities through audit logs, submission metadata, and delivery records.
Article 32 – Security of processing Implemented Encryption at rest and in transit, access controls, automated release gates, and security sign-off process are in place.
Article 33 – Breach notification Process in place Incident response process includes detection, triage, containment, remediation, and customer notification. Contact [email protected] for breach reports.
Article 44–49 – International transfers Standard clauses available FormsFort infrastructure is hosted in the United States. Standard contractual clauses or equivalent mechanisms are available upon request.
Article 17 – Right to erasure Implemented Users can request account deletion from the dashboard. Completion anonymizes identity data. Form owners can configure per-form retention periods.

Implemented controls

These controls are currently implemented and verified in CI. They form the technical and organizational measures referenced in the DPA.

Data minimization

  • Raw submission bodies are never stored; only field names, hashes, request IDs, statuses, and redacted metadata are retained
  • Successful delivery payloads are redacted after delivery
  • Sender IP addresses are hashed before storage; country is derived but raw IP is not retained

Encryption

  • TLS for all traffic (API, dashboard, admin, website)
  • Email retry payloads, webhook URLs, retry payloads, captcha secrets, and integration config encrypted at rest
  • OAuth refresh tokens encrypted at rest in the database
  • Access keys hashed with a server-side pepper; full keys never exposed

Access controls

  • Dashboard routes require authenticated sessions
  • Dashboard support requests require authenticated sessions
  • Admin support operations require Basic Auth and a server-only admin token
  • Cross-site mutations blocked by Origin and Fetch Metadata checks
  • Admin app protected by Basic Auth credentials

Data retention and deletion

  • Configurable retention window (default 60 days, per-form overrides 1–365 days)
  • Automated retention worker deletes operational metadata on schedule
  • Account deletion anonymizes identity data and removes credentials in one transaction
  • Suppression list entries can be manually removed by admins

Audit and accountability

  • Audit logs record all sensitive admin mutations with actor, action, target, and redacted metadata
  • Every API response includes X-Request-Id and X-Trace-Id for traceability
  • Release gates enforce config checks, migration evidence, restore drills, and security sign-off before deployment

Subprocessor management

  • Public subprocessor list maintained and updated when services change
  • Third-party integrations only activated when configured by the form owner
  • Webhook targets validated for HTTPS, no embedded credentials, and no private addresses

Incident response

  • Automated alert evaluation for queue backlogs, delivery failures, error rates, and abuse signals
  • External incident webhook routing with warning, critical, and escalation channels
  • Request tracing for incident investigation and correlation

Security testing

  • CI gate runs formatting, type checks, tests, migration checks, and production builds on every push
  • Production config check rejects unsafe defaults, missing secrets, and insecure URLs
  • Restore verification runs against isolated databases to validate backup integrity

Requesting a DPA

Standard DPA

FormsFort can provide a standard Data Processing Agreement for customers who require a signed processor agreement. The DPA covers:

  • Subject matter and duration of processing
  • Nature and purpose of processing
  • Types of personal data and categories of data subjects
  • Obligations and rights of the controller
  • Technical and organizational measures (referencing this page)
  • Subprocessor list (referencing the subprocessors page)
  • Data retention and deletion policies
  • Breach notification procedures
  • International data transfer mechanisms
Request a DPA

Custom DPA

If your organization requires a custom DPA with specific clauses, contact the FormsFort privacy team with your requirements. Custom DPAs are reviewed on a case-by-case basis.

Discuss custom DPA

Privacy contact

For DPA requests, data subject access requests, or privacy questions, contact [email protected].

Contact privacy Subprocessor list