Security is part of how we build Qubeforms, from accepting a submission to delivering it to your systems. Read about the controls below, our Privacy Policy, and our responsible disclosure policy.
Our commitment to security
Qubeforms is operated by Qubus Labs, LLC. We protect form workflows with several layers of controls, including encrypted submission storage, authenticated account access, verified notification recipients, private attachments, and abuse prevention. This page describes safeguards implemented in Qubeforms. Some features, including uploads, team inbox access, webhooks, and advanced spam controls, depend on your plan and form settings.
Encrypted connections
Qubeforms uses HTTPS for its production website and API, protecting information in transit between your browser and the service. Outbound webhooks are restricted to HTTPS destinations. Use HTTPS on the websites where you embed forms and on the systems receiving your submissions. Once a message reaches an external email service or integration, its further handling depends on that destination's security controls.
Encryption of stored form data
Form submission payloads, saved draft payloads, and webhook signing secrets are encrypted at the application level using AES-256-GCM, which provides authenticated encryption. Inbox search uses keyed search tokens derived from submitted values. Account records, delivery metadata, and other operational information are handled separately; this description of payload encryption does not imply that every database field is encrypted. Authorized users and service processes can access decrypted content when needed to display, route, or deliver submissions.
Account and session protection
Customer registration, password verification, and password recovery are handled through the connected account and billing portal. Sign-in attempts are rate limited, and the connection between the portal and Qubeforms uses signed, short-lived assertions with replay protection. Customer sessions expire according to the configured session lifetime. Authentication cookies use Secure, HttpOnly, and SameSite protections, and dashboard changes are protected against cross-site request forgery.
Access controls and team permissions
Qubeforms checks form ownership and team membership before granting customer access to forms and submissions. Where team inbox access is included, Viewer members can read and export submissions, while Triage members can also update inbox status, assignments, and notes. Form configuration and team membership changes remain owner-only. Staff management routes require administrator access and the relevant management permissions. Review shared access regularly and remove teammates who no longer need it.
API keys and public form endpoints
Public form keys are intended to appear in website code so visitors can submit a form; they do not grant inbox read or account-management access. Reading submissions through the API requires a separate, revocable key scoped to one form. Read keys are shown when generated and stored as Argon2id hashes for verification. Keep read keys, webhook secrets, and draft access tokens out of public source code, URLs, and analytics. Revoke or rotate credentials if they are exposed.
Spam and abuse prevention
Submission controls include input size and structure checks, per-form origin rules, rate limits, honeypot scoring, and content-based spam signals. Redirect destinations are checked against the form's configured allowlist. Advanced controls on eligible plans include hCaptcha, Google reCAPTCHA, or Cloudflare Turnstile, configurable thresholds, and additional content and velocity rules. Suspected spam can be quarantined without notification delivery or rejected according to the active policy. Origin rules help restrict browser submissions but do not replace authentication or other abuse controls.
Privacy-conscious security signals
For submission abuse detection, Qubeforms stores keyed IP hashes and request fingerprints instead of raw IP addresses in submission records. These identifiers are pseudonymous and may still be personal information. Each stored submission includes a Trust Passport recording its spam score, classification reasons, and relevant consent and privacy-notice metadata. This makes filtering decisions reviewable. Infrastructure providers and CAPTCHA services may separately process IP addresses as described in our Privacy Policy.
Email and relay protection
Form notification messages go only to recipient addresses that have completed verification. Routing rules can select among those verified destinations, and public form fields cannot choose an arbitrary notification recipient. A submitter address can be used for Reply-To. Optional autoresponders send acknowledgments to submitter addresses and have separate daily and per-recipient limits to reduce abuse. These controls help prevent forms from becoming unrestricted email relays.
Private attachments and upload checks
On plans with uploads, attachments use a private object storage and are uploaded with server-side AES-256 encryption requested. Downloads use time-limited signed links; anyone holding a valid link can access the file until that link expires, so treat it as sensitive. Upload processing enforces file count and size limits, inspects detected content types, and rejects selected executable and active-content types. Treat files received through public forms as untrusted and use appropriate protections before opening them.
Signed webhooks
Webhook deliveries carry an HMAC-SHA256 signature covering the timestamp and raw request body. Your receiving system should verify the signature and reject stale timestamps before accepting an event. Qubeforms checks webhook destinations for public network addresses, restricts requests to HTTPS, and does not follow redirects, helping prevent access to private or internal systems. Keep the signing secret private and rotate it if compromised.
Delivery reliability and retention
Outbound delivery uses queued jobs, recorded outcomes, and retries for failed attempts. Idempotency keys help prevent duplicate submissions when a client retries a request. Submissions and their attachments receive retention deadlines when stored, and scheduled cleanup removes expired records and files. Default retention is 30 days on Free, 90 days on Starter, and 365 days on Pro and Business, with shorter form settings available. Dashboard deletion removes ordinary inbox access and does not immediately erase every stored copy. Export important records before their deadline, and secure copies delivered to email, webhooks, or your own storage.
Your role in protecting data
Use a unique password, grant account access carefully, restrict allowed origins and redirect destinations, and enable appropriate spam controls for your forms. Collect only the information you need and provide clear privacy notices. Do not collect passwords, full payment-card details, or sensitive health or other regulated information unless we have agreed in writing to support that use and the required safeguards. If you have specific contractual, regulatory, or data-location requirements, contact us before submitting the affected data. No service can guarantee absolute security; your forms and connected systems are part of the protection of your data.
Report a security issue
Report a suspected vulnerability to Qubus Labs, LLC at security@qubeforms.com and follow our responsible disclosure policy. Include the affected feature, potential impact, reproduction steps, and relevant request identifiers. Avoid sending live secrets or personal data in the initial report. If you encounter another customer's information, stop testing and contact us so we can arrange a secure way to investigate.