Data Encryption and Security

WittyForm takes security seriously. Your data and your respondents' data are protected by industry-standard encryption, strict access controls, and comprehensive security practices at every level of the platform.

Encryption in Transit (TLS 1.3)

All data transmitted between your browser and WittyForm servers is encrypted using TLS 1.3, the latest version of the Transport Layer Security protocol. This ensures that:

• Form responses cannot be intercepted or read while traveling over the network.
• Login credentials and session tokens are protected from eavesdropping.
• API calls and webhook payloads are encrypted end-to-end.
• All connections are forced to HTTPS with no fallback to unencrypted HTTP.

TLS 1.3 provides faster handshakes and stronger cipher suites compared to earlier versions, giving you both better security and better performance.

Encryption of Stored Credentials (AES-256-GCM)

The most sensitive values WittyForm stores on your behalf are encrypted at the application layer with AES-256-GCM before they are written to the database, so they are never readable from the database itself.

• Third-party integration tokens (Slack, Google Sheets, Google Drive) are encrypted with AES-256-GCM.
• Custom SMTP credentials are encrypted with AES-256-GCM.
• Account passwords are handled entirely by our authentication provider and are never stored by WittyForm.
• Card details never touch WittyForm servers — payments are handled directly by our PCI DSS Level 1 certified payment processors.
• Encryption keys are held outside the database and can be rotated on demand.

Server Security

WittyForm infrastructure is designed with multiple layers of protection:

• Network isolation: Application servers, databases, and internal services are deployed in isolated network segments with strict firewall rules.
• DDoS protection: Built-in protection against distributed denial-of-service attacks ensures your forms remain available even during attack attempts.
• Automatic patching: Server operating systems and software dependencies are kept up to date with the latest security patches.
• Intrusion detection: Monitoring systems watch for suspicious activity and alert our security team to potential threats.

Backup Procedures

WittyForm maintains automated, encrypted database backups to protect against data loss:

• Automated backups every 6 hours: Full database backups are taken every 6 hours.
• Encrypted backups: Every backup is encrypted with AES-256 before it is written to disk.

Access Controls

Strict access controls are in place at every level:

• Role-based access: Team members can be assigned roles (owner, admin, editor, viewer) that limit what they can see and do.
• Session management: Sessions expire after a period of inactivity. You can view and revoke active sessions from your account settings.
• Employee access: WittyForm team members have access to infrastructure only on a need-to-know basis with full audit logging.
• API key scoping: API keys can be scoped to specific permissions so integrations only have access to the data they need.

Security Audits

WittyForm undergoes regular security assessments to identify and address vulnerabilities:

• Automated vulnerability scanning runs continuously against all public-facing services.
• Code reviews include security checks as part of the development process.
• Dependency scanning detects known vulnerabilities in third-party libraries.

Compliance and Documentation

WittyForm follows industry-standard security practices and supports the documentation most organisations need for vendor reviews:

• Formalised security policies and procedures are in place.
• Access to systems is logged and monitored via audit logs.
• Incident response procedures are documented and tested.
• Changes to the platform follow a controlled change-management process.
• A signed Data Processing Agreement (DPA) is available on request for GDPR compliance.

If your organisation has specific compliance requirements or needs additional documentation for a vendor review, contact our team at [email protected].