Subprocessors
Third-party services that process data.
FormsFort uses the following third-party services to operate the platform. This list is updated when subprocessors change. FormsFort does not sell data to subprocessors.
| Service | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare | Email delivery (Cloudflare Email Sending) | Recipient email address, sender name, email subject, submission content (encrypted in transit) | United States |
| Stripe | Payment processing and subscription management | Email address, billing address, payment method details (handled by Stripe; FormsFort stores only Stripe customer ID) | United States |
| Google (Sheets API) | Google Sheets integration for form submission data export | OAuth refresh tokens (encrypted at rest in FormsFort), spreadsheet IDs, submission field data (written to user-selected spreadsheets) | United States |
| ClamAV | File attachment malware scanning | File bytes streamed to the scanner for signature matching; no persistent storage by the scanner | Self-hosted alongside API infrastructure |
| S3-compatible object storage | Temporary file upload storage for advanced uploads | Uploaded file objects, storage keys, MIME types, and expiry timestamps | Determined by the configured storage provider |
| Slack (incoming webhooks) | Native Slack notification delivery | Webhook URL (encrypted at rest), submission field names and values formatted for Slack messages | United States |
| Discord (incoming webhooks) | Native Discord notification delivery | Webhook URL (encrypted at rest), submission field names and values formatted for Discord messages | United States |
| Telegram (Bot API) | Native Telegram notification delivery | Chat ID, bot token (encrypted at rest), submission field names and values formatted for Telegram messages | Global |
| Google reCAPTCHA | Bot detection and spam prevention | reCAPTCHA response tokens verified with Google; site key and encrypted secret stored in FormsFort | United States |
| hCaptcha | Bot detection and spam prevention | hCaptcha response tokens verified with hCaptcha; site key and encrypted secret stored in FormsFort | United States |
| Cloudflare Turnstile | Bot detection and spam prevention | Turnstile response tokens verified with Cloudflare; site key stored in FormsFort | United States |
| Microsoft Clarity | Website analytics and session replay (marketing site only) | Anonymous browsing behavior on formsfort.com; no form submission data | United States |
Notes
- User-initiated integrations (Google Sheets, Slack, Discord, Telegram) are only activated when a form owner configures them from the dashboard. FormsFort does not send data to these services unless the integration is enabled.
- Captcha providers are only contacted when a form has captcha enabled. Free plans use shared captcha keys; paid plans can configure custom keys.
- Email delivery is handled by Cloudflare Email Sending. The production email sender is
[email protected]. - File uploads are scanned by a self-hosted ClamAV instance before delivery. The scanner runs alongside the API infrastructure and does not persist file bytes after scanning.
- Microsoft Clarity is used only on the marketing website (formsfort.com) and does not process form submission data.
Subprocessor changes
When FormsFort adds or changes a subprocessor, this page is updated. For questions about subprocessors, contact [email protected].