Encryption

Three places where Formspring encrypts data:

In transit

Every endpoint enforces HTTPS. We don't accept plaintext POSTs to form endpoints, the REST API, or the MCP server. HSTS is set with a 1-year max-age and includeSubDomains.

At rest (databases)

The application database stores submission payloads in plaintext (queryable). Sensitive form configuration values — API keys, captcha secrets, Akismet keys — are encrypted at the column level using your application key (AES-256). They're never returned to the dashboard or API after creation; you set them once and we use them server-side.

At rest (file uploads)

Uploaded files live in private object storage. The bucket is private; downloads happen via short-TTL signed URLs (15 minutes by default). No public read access. AES-256-GCM at the storage layer.

Tokens

API tokens are stored as SHA-256 hashes. The plaintext value is shown once at creation and never written to disk. Lost? Revoke and mint a new one.

Key rotation

The application key (used for column-level encryption of secrets) is rotatable on Scale plans with our help; standard plans run on the platform-managed key.