Security

How we protect your data and payments.

zyntForms handles form responses and money, so security is part of the product, not an add-on. Here is what we do today.

• Accounts

  Passwords are stored hashed, never in plain text. Sessions use short-lived access tokens and an HTTP-only refresh cookie. Google sign-in is supported.

• Data isolation

  Each workspace is a separate tenant: forms, responses and members never cross workspace boundaries, and access is enforced with database row-level security.

• Uploaded files

  Files uploaded to forms are kept in private storage and served only through signed, expiring links. There are no public buckets.

• Payments

  Payments are processed by Pesapal on its hosted checkout. Card numbers and mobile-money PINs are entered with the payment provider and never stored by zyntForms.

• Spam protection

  Public forms and sign-up pages use Cloudflare Turnstile and rate limiting to reduce automated abuse.