01
Access belongs to a workspace
Customer requests are authorized against workspace membership. Inbox records, form configuration, exports, API keys, and attachment downloads stay within that boundary.
Clear boundaries. Considered defaults.
Security is in the details.
Form data deserves careful handling. Control who can access your data, protect your forms, and follow each submission with confidence.
From the first request to the next action.
Read the protection guide02
Team access, on your terms.
Invite people to your workspace with the role their work requires. Protect your sign-in with an authenticator, manage account recovery, and end other sessions when you need to.
03
Protection before processing
Rate controls, published validation, and honeypot quarantine reduce unwanted traffic. Optional CDN protection adds signed, expiring, single-use attempts; configurable email and matching-content limits help control repeats. A public source URL identifies a form; it is not a secret or proof of a visitor’s identity.
04
Private attachments
Files use application-managed private storage and scoped, short-lived download links. Size and type validation are enforced. Uploaded content is marked unscanned; malware scanning is not currently provided.
05
Destinations stay under your control
Submitted data cannot change configured webhook destinations. Outbound webhooks use HTTPS, destination address checks, and request signing. Private-network destinations and redirects are blocked.
06
Outcomes without guesswork
Acceptance and external processing have distinct records. A non-idempotent request that times out can be recorded as an unknown outcome instead of being silently repeated.
A shared responsibility
Careful by design.
Considered in use.
Handle your data with care
Choose fields that request only what you need. Review team permissions regularly, keep your API keys private, and export information you want to preserve before its retention period ends.
Do not use Form Bastion for payment card details, passwords, medical records, government identifiers, or other highly sensitive information. File validation does not make uploaded content safe to execute.
Report a security concern
Email [email protected] with the affected URL and enough detail to reproduce the issue. Avoid including real customer submissions, passwords, API keys, or attachment contents in your report.