This page describes the current product controls documented by FormWork. It helps you assess an implementation; it is not a certification, independent security audit, or contractual security commitment.
Accounts are the access boundary
Projects organise resources within an account. They do not provide project-specific member permissions. Account members have broad access to the account’s projects, forms, entries, and other resources.
There are two roles, Admin and Standard. Admin is specifically required for form deletion and Stripe billing actions. Standard is not a read-only role or a restricted-data reviewer role. Use separate accounts when clients or teams must not see or edit one another’s resources. See the complete users and permissions guide.
Server-to-server API access
API keys belong to one account and act as their creating user. There is no per-key permission selector. The account header must agree with the key’s account where required.
The complete key is shown once. Keep it in a protected server-side secret store, give each integration its own named key, and revoke retired keys. Never put an account API key into an embedded form or public browser code.
Respondent entry endpoints use a separate entry access key in X-Formwork-Entry-Key. Treat that key as access to the respondent’s entry and follow the endpoint requirements in the API reference.
Rules and history
Form logic and validation run on the server. This keeps the configured processing rules in the form engine, but it does not replace testing, appropriate access management, or careful integration design.
Form versions preserve the schema associated with an entry. Entry revisions record answer changes. These product histories should not be interpreted as an independently certified or immutable compliance audit log.
Sign-in and operational responsibilities
The current interface uses email-and-password sign-in and supports changing a password with the current password. The published interface does not offer a per-device session manager or administrator session revocation controls. Review account membership and API keys when access requirements change.
You choose what information to collect, who belongs to an account, and where configured connectors send information. Test downstream failure handling and review the data you send to external systems.
Assessing specific requirements
For hosting region, data retention, contractual terms, or certification requirements, contact the FormWork team for confirmation before relying on an assumption. This page does not assert a hosting region, retention schedule, or security certification.