Security

Encryption

• All traffic is encrypted in transit with TLS 1.2+, terminated at our edge network (Cloudflare) and between edge and origin.
• Passwords are hashed with bcrypt (cost 12) — never stored or logged in plaintext.
• Connected integration credentials and custom SMTP passwords are encrypted at rest with AES-256-GCM.
• Session and step-up tokens are stored only as SHA-256 hashes; the plaintext token exists solely in your browser's cookie.

Authentication

• Sign-in with email/password or OAuth (Google, GitHub); email verification is required before accounts can publish forms.
• Optional TOTP two-factor authentication for every account — and mandatory for platform administrators, who must re-verify with an authenticator code every browser session.
• Authenticator challenges rate-limit after repeated failures.

Infrastructure

• Services run in isolated containers; the database and cache are not exposed to the public internet and are reachable only from the application's private network.
• Administrative access to production infrastructure is restricted to key-based SSH and protected accounts.
• Our origin sits behind Cloudflare; customer-facing TLS for custom domains terminates at the edge.

Payments

Subscription payments are processed by Paddle / Lemon Squeezy / Stripe, and respondent payments run directly on the form owner's own Stripe or PayPal account. Card numbers never touch Zunoform's servers.

Your controls

• Active session list with remote sign-out in Settings.
• Per-form spam protection (reCAPTCHA) and response limits.
• Export and deletion of your forms and responses at any time.

Responsible disclosure

Found a vulnerability? We want to hear about it. Email [email protected] with details and steps to reproduce. We commit to acknowledging reports promptly, not pursuing legal action against good-faith research, and crediting reporters who wish to be named.