Security you can trust.

Security Overview

WittyForm is committed to protecting the confidentiality, integrity, and availability of your data. We implement comprehensive security measures across our entire infrastructure and development lifecycle. For details on how we handle your personal information, see our Privacy Policy.

Incident Response

WittyForm maintains a formal incident response plan to handle security events swiftly and transparently. Our commitment to data protection, as outlined in our Terms of Service, extends to how we detect, respond to, and communicate about security incidents.

Detection and Assessment

• Detect and assess within 24 hours — Upon detection of a potential security incident, our security team initiates an immediate assessment to determine the scope, severity, and impact within 24 hours.
• Automated monitoring systems and intrusion detection provide continuous surveillance, enabling rapid identification of anomalous activity.

Regulatory Notification (GDPR Article 33)

• Notify supervisory authority within 72 hours — In compliance with GDPR Article 33, WittyForm will notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals.
• The notification will include the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to mitigate the breach.

User Notification (GDPR Article 34)

• Notify affected users without undue delay — Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, WittyForm will communicate the breach to the affected data subjects without undue delay, as required by GDPR Article 34.
• Notifications will be sent via email and, where applicable, through in-app notifications, describing the breach in clear and plain language along with recommended protective measures.

Documentation and Remediation

• Document the breach — All security incidents are thoroughly documented, including the facts of the breach, its effects, the timeline of events, and all remedial actions taken.
• Post-incident reviews are conducted to identify root causes and implement preventive measures to reduce the likelihood of recurrence.
• Incident records are maintained for a minimum of 5 years in accordance with regulatory requirements.

Reporting a Vulnerability

We value the security community and welcome responsible disclosure of vulnerabilities. If you discover a potential security issue, please report it to us so we can address it promptly.

• Email — Report vulnerabilities to [email protected]. Please include a detailed description of the vulnerability, steps to reproduce, and any supporting evidence.
• 48-hour acknowledgment — We will acknowledge receipt of your report within 48 hours and aim to provide an initial assessment within 5 business days.
• Responsible disclosure — We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate the issue. We will coordinate with you on disclosure timing.
• Safe harbor — We will not pursue legal action against researchers who report vulnerabilities in good faith and in compliance with our responsible disclosure guidelines.

Data Protection Impact Assessment

In accordance with GDPR Article 35, WittyForm has conducted a Data Protection Impact Assessment (DPIA) to identify and mitigate risks associated with our data processing activities:

• Processing description: WittyForm collects and stores form responses, quiz answers, contact information, and file uploads on behalf of data controllers (our customers). Processing includes analytics, AI-assisted form generation, email delivery, and third-party integrations as configured by the controller.
• Necessity and proportionality: Data is processed only as necessary to provide the services requested by the controller. AI processing occurs only when explicitly initiated. Third-party data sharing happens only through integrations the controller configures.
• Risks identified and mitigations: Unauthorized access (mitigated by TLS 1.3, RBAC, audit logging); data loss (mitigated by encrypted backups every 6 hours); international transfers (mitigated by SCCs and EU-US DPF); excessive data retention (mitigated by configurable retention policies with automated enforcement).
• Data subject rights: Controllers can fulfill data subject requests (access, export, deletion, restriction) through the dashboard or API. WittyForm provides tools for consent collection, data export (CSV, JSON, XLSX), and individual response deletion.

This assessment is reviewed annually or whenever significant changes are made to processing activities. For a copy of the full DPIA, contact [email protected].