Security

Your visitors

• Hosted form pages set no cookies, load no third-party scripts and run no analytics.
• Visitor IP addresses and browsers are stored only if you switch that on for a form.
• Spam protection runs in the visitor's browser (proof of work) without Google. reCAPTCHA is only used if you choose it.

Your data

• Stored on servers in the United Kingdom.
• Every workspace is isolated in the database itself (row-level security), as well as in the application.
• Credentials you give actions (webhook passwords, tokens, mail server logins) are encrypted at rest and never shown again in full.
• Webhook, n8n and ntfy addresses are checked so they cannot be pointed at our own network.
• Passwords are hashed with Argon2id; two-factor sign-in and single sign-on are available; sessions are rotated at sign-in.
• An audit log records sign-ins, member and role changes, API keys, plan and action changes.
• Single-use links and anonymous follow-up codes are stored only as fingerprints (SHA-256). We cannot tell which link sent an answer, and a lost code cannot be recovered. Codes are never put in web addresses or in the emails we send your team.
• Submissions are kept for your plan's retention period, or a shorter one you set for a form, then deleted with their files. Deleting a workspace removes everything after a short grace period.

End-to-end encrypted forms

On an encrypted form, the visitor's browser encrypts the answers (ECDH P-256 and AES-256-GCM, standard browser cryptography) with your workspace's public key before anything is sent. We store only that ciphertext. Your private key is kept on our servers only in a form locked by your vault passphrase or your recovery code, neither of which we ever see.

What this protects against

• A leak of our database or backups, and anyone with access to them, including us.
• Logs, error reports and requests for stored data: there is nothing readable to hand over.
• Notifications and integrations leaking content: they say only that a submission arrived; webhooks receive the sealed envelope.

What it does not

The code that encrypts and decrypts runs in the browser, and we serve it. If our servers were compromised, changed code could read answers as they are typed, or your key as it is unlocked. That is true of every web-based end-to-end encrypted service. Check the key fingerprint shown on your form against the one in your settings, and keep your devices and passphrase safe. If you lose both the passphrase and the recovery code, nobody can recover the submissions, including us.

Encrypted exports open offline with intake-cli decrypt, so you never depend on us to read your own data.

Reporting a problem

If you think you have found a security vulnerability in Intake, email intake@starstorm.dev with what you found and how to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and do not access other people's data, degrade the service, or run automated scans against it while investigating. We will acknowledge your report, keep you updated, and credit you if you would like. Our security.txt has the same details.