Host OG Forms on Cloudflare infrastructure
Host the marketing site and OG Forms app on Cloudflare, which also stores forms, answers, and uploaded files. Keep the public site on a separate Worker with its own marketing database, and no app database binding or credential that can access form responses.
Protect data in transit with HTTPS. Check workspace membership and role on each request, and keep workspaces separate. Sign in with Google; OG Forms does not see or store your Google password. Do not interpret HTTPS as a claim about encryption at rest, a certification, or an infrastructure guarantee.
Block automated spam at submission
Turn on two protections by default to make automated submissions harder.
Add a honeypot, a hidden field that people do not see but bots may fill in. Flag submissions that fill it as suspicious.
Check the submitting browser with Cloudflare Turnstile, which can ask a visitor for an extra check when needed. Use these protections to reduce spam, not as a guarantee that every automated submission will be blocked. Read the Cloudflare Turnstile documentation for details about the service.
Use AI features with security in mind
Use AI to create forms, edit them, and analyze responses when those features launch. Check the Privacy Policy: it says AI processing is not live yet.
Send the text you ask AI to work on to an AI provider when the features are available, and name that provider in the Privacy Policy before launch. Refer to OWASP guidance for generative AI and the NIST AI Risk Management Framework as references for assessing risk. Neither is a certification, endorsement, or claim of compliance, and do not assume safeguards beyond those currently described.
Handle personal information transparently
Use account details, forms, settings, workspace and teammate records, uploads, responses, and technical details to sign people in, save forms, collect answers, prevent abuse, provide support, send requested system emails, and improve OG Forms. Do not sell personal data or share it for advertising.
Store a respondent's answers and email only when the form asks for it, along with uploaded files and a scrambled code derived from the respondent's IP address for spam and duplicate checks. Do not store the raw respondent IP address. Record IP address and browser details for account sign-in sessions. Keep account data while the account is open, and answers until their owner deletes them or their account.
Keep waitlist emails until OG Forms opens and sends an update, then remove them on request. Keep deleted app data in the trash for seven days before removing it, and allow backup copies to remain for up to 30 more days. Keep contact and live chat messages for up to two years. Read the Privacy Policy for analytics retention and other details. See how to restore deleted answers or export workspace data.
Ask to access, correct, copy, or delete your data, or to stop a use, through the contact page. Ask the form owner first to change or delete an answer you submitted.
Support GDPR rights with clear privacy practices
Publish what data OG Forms collects, why it is used, which service providers handle it, where it may be processed, how long it is kept, and how to make a privacy request. Accept requests to access, correct, delete, or receive a copy of data, or to stop a use. The Privacy Policy says we respond within 30 days and may ask you to confirm your identity.
Use these practices to support GDPR requirements, not as proof of full compliance. OG Forms does not claim GDPR certification or full GDPR compliance. Read the Privacy Policy rights section or the European Commission's overview of GDPR rights.
Report a security issue
Report a vulnerability or ask a security question through the contact page. Share enough detail to explain the issue, but do not include passwords, access tokens, or real customer responses.