Security

This page describes how databooq protects the data it stores: the forms owners build and the responses respondents submit. It is written to be checked against, not to impress.

Where data lives

• All application data, the database and uploaded files are hosted on servers in Germany (Hetzner), inside the European Union.
• Encrypted backups run nightly: database dumps plus a mirror of uploaded files, with an offsite copy kept on separate infrastructure within the EU. Restore drills verify that the backups actually restore.
• Backup copies of deleted data rotate out within 30 days.

Encryption and credentials

• All traffic is encrypted in transit with TLS; there is no plain-HTTP access.
• Passwords are hashed with scrypt. We never store or see plaintext passwords.
• Sign-in uses short-lived access tokens with rotating refresh cookies (HttpOnly, Secure; 24 hours, or 72 hours with “Keep me signed in”).
• Third-party integration tokens (Google Sheets sync) are stored encrypted with authenticated encryption, so a tampered record fails to decrypt rather than being silently accepted.

Isolation and integrity

• Uploaded files are private by default and never publicly listed.
• Capacity bookkeeping (seat limits, waitlists) runs inside database transactions, so concurrent submissions cannot corrupt counts or double-book seats.
• Webhook deliveries are signed, so receiving servers can verify that a payload really came from us.
• Infrastructure services run isolated from each other with least-privilege access.

What we do not do

• No analytics, advertising or tracking cookies on published forms or inside the app. Our public marketing pages and the signup page carry a Google Ads measurement tag; for visitors in the EU, EEA, UK and Switzerland it stores nothing unless they accept, and everywhere it can be switched off from the banner.
• Form view counting is a plain aggregate counter: no cookies, no fingerprinting, no per-visitor records.
• We do not sell personal data and we do not use respondent data for anything but serving the form owner.

Reporting a vulnerability

If you believe you have found a security issue, email [email protected] with enough detail to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly; we read these reports personally and will keep you informed. A machine-readable contact is published at /.well-known/security.txt.