Compliance
Compliance
Data location, GDPR functions, security controls, and which certifications Formabi does not hold.
Hosted in Germany
The application, the database and every backup of both sit in a data centre in Falkenstein, Germany. Transactional email leaves through a relay in France. No part of your form data passes through a provider outside the EU.
- ✓ Two sub-processors in total, both in the EU
- ✓ Website analytics and CRM are self-hosted, not handed to a third party
An ISO/IEC 27001-certified data centre
Our servers run at Hetzner Online GmbH, whose German data centre parks are certified to ISO/IEC 27001 for information security management. That certificate is Hetzner's, not ours. It covers the physical site, power, access control and network beneath Formabi.
GDPR functions in the product
Data-subject requests are handled in Formabi itself, without a support ticket or manual export.
- ✓ Right of access (Art. 15): find everything held on a person across every form and export it as one bundle
- ✓ Right to erasure (Art. 17): purge a field, a submission, a form or a whole workspace, and every request is recorded
- ✓ Storage limitation (Art. 5): set a retention period per workspace, and older submissions are purged automatically
- ✓ Consent (Art. 7): stored with a snapshot of the exact wording shown, with withdrawal recorded against it
- ✓ Records of processing (Art. 30): an audit log of sign-ins, changes and data-subject actions, kept for 365 days
Encrypted in transit and at rest
Every connection is HTTPS only, over TLS 1.2 or 1.3 with HSTS. Databases and tenant volumes sit on encrypted disks. Backups are encrypted on the server before they go anywhere.
Authentication
Two-factor authentication with recovery codes, and single sign-on through any OpenID Connect provider, such as Google Workspace, Microsoft Entra ID or Okta. You can enforce SSO, restrict sign-up to your email domain and sync roles from your directory.
- ✓ Passwords hashed with bcrypt, and session tokens stored only as hashes
- ✓ See every signed-in session and revoke any of them
- ✓ Login attempts are rate-limited
Separate database per customer
Each customer runs in its own container against its own database. The database server lets a tenant open only the database named for it, and connection rights are revoked from everyone else.
Backups and restore tests
Encrypted nightly backups, kept seven daily, four weekly and six monthly. Restores are tested; the last test was on 22 September 2026.
Infrastructure changes are reviewed and versioned
Our infrastructure is declared in code (NixOS), so each server's configuration is version-controlled and every change goes through review. Dependencies are scanned for known vulnerabilities on every release build.
Renewable electricity
Hetzner powers its German data centres with electricity from renewable sources.
Certifications
Formabi holds no ISO 27001 or SOC 2 certification. Everything on this page is a control we run and can evidence. The full reference, written for due diligence, is on Security & Compliance, and the providers we use are listed on Sub-processors.
Audit documentation
On request: data processing agreement (Art. 28 GDPR), completed security questionnaire, walkthrough of these controls.
Or email us directly at help@formabi.com