How we protect your data
Shapeform is run by ZekerCRM (eenmanszaak (sole proprietorship)) in the Netherlands. This page describes where data lives and how it's protected. For anything not covered here, email support@shapeform.net.
Where data is hosted
Shapeform is hosted in the European Union. The application runs on Vercel in its Dublin region, the database is hosted by Turso on AWS in Ireland (eu-west-1), and uploaded files are stored in Vercel Blob in Dublin. Forms, responses and accounts are stored in Ireland.
A few services we use are based in the United States: email delivery (Postmark), payments (Stripe), and the AI model behind the form generator (Anthropic). They receive only what they need for their task. Those transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. See the Privacy Policy.
Encryption
All traffic uses HTTPS (TLS). Our database and file storage providers encrypt stored data at rest.
On top of that, Shapeform encrypts the secrets it stores itself (integration tokens, webhook URLs, OIDC client secrets) with AES-256-GCM, and stores passwords only as bcrypt hashes. API keys and invite links are stored as SHA-256 hashes, so they can't be read back.
Access control
Team, Agency and Enterprise accounts get roles (members and read-only viewers) and an audit log of publishing, deletions, exports, team and settings changes, API reads and sign-ins, kept for 12 months and exportable as CSV. Enterprise adds SAML/OIDC single sign-on, optionally enforced for your whole email domain, with domain ownership proven by a DNS record.
Session cookies are HTTP-only and secure. Data retention rules can delete responses automatically after a period you choose.
Application security
- Rate limiting on sign-up, submissions, uploads, invites, imports and the API.
- Spam protection on forms (honeypot, timing checks, optional Cloudflare Turnstile).
- Forms that ask for passwords, codes or full card details are screened and blocked at publish; respondents can report any form.
- Outgoing webhooks and imports are protected against requests to internal networks (SSRF).
- Uploaded files are served with a restrictive content security policy and download rather than run in the browser.
- CSV exports guard against spreadsheet formula injection.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and file storage (Vercel Blob) | EU: Dublin, Ireland (dub1) |
| Turso (ChiselStrike Inc.) | Database | EU: Ireland (AWS eu-west-1) |
| Stripe | Subscriptions, invoices, payments in forms | United States / Ireland |
| Postmark (ActiveCampaign, LLC) | Transactional email | United States |
| Anthropic, via Vercel AI Gateway | AI form generation, abuse checks (only the text being checked) | United States |
| Cloudflare, Inc. | Optional bot check (Turnstile) on forms | Global network |
Services you connect yourself (Google, Slack, Notion, Airtable, Discord, Zapier, Make, webhooks) receive the data you send them under their own terms.
DPA, compliance and questionnaires
Our data processing agreement (GDPR Article 28) is part of the Terms of Service; we're happy to sign a copy. We don't hold SOC 2 or ISO 27001 certification yet. Our infrastructure providers do, and we fill in security questionnaires on request.
Reporting a vulnerability
Found a security issue? Email support@shapeform.net with details. Please give us a reasonable time to fix it before disclosing it publicly. We don't take legal action against good-faith research.