Last updated: September 8, 2026
CalcForms stores two kinds of data on your behalf: the forms you build, and the submissions your customers send. This page explains how both are protected. It is written to be checked against, so it states only what is actually in place. Questions go to security@badabingapp.cc.
Forms, submissions and file uploads are stored in a Postgres database and a private storage bucket hosted by Supabase in the United States. The website and form pages are served by Cloudflare. Transactional email is sent by Resend. When a form owner uses the AI builder, the owner's form description is sent to OpenRouter to generate the form structure; submission contents are never sent to any AI provider. Those four are our only subprocessors, and the privacy policy lists them with the same scope.
All traffic to and from CalcForms uses TLS. This includes form pages, the dashboard, the MCP connector endpoint, webhook deliveries (which are refused unless the destination is HTTPS), and connections from our edge code to the database and storage. Data at rest is stored on our hosting providers' managed infrastructure.
Every owner-scoped table is protected by Postgres row-level security keyed to the owner's account. A signed-in user can only read or change their own forms, submissions, invites and sessions, and that rule is enforced by the database, not only by application code.
The browser and connected assistants only ever hold a public, publishable key plus a token for the signed-in user. The privileged service key that can bypass row-level security exists only in server-side code and is never sent to a browser or a client.
Calculated fields are private to the form owner unless the owner marks one as visible. The public form page receives only the inputs it needs to render and the outputs marked visible. Private formulas, private results, webhook settings and the owner's identity are stripped on the server before the page is sent, so they cannot be recovered from the page source.
File uploads go to a private bucket. Files are written only under the folder of a published form and cannot be listed or enumerated across forms.
Each submission receipt page is protected by a random token in the link, so submission records cannot be found by guessing IDs.
Sign-in is by one-time email code or by email and password, handled by Supabase Auth. Assistants such as ChatGPT and Claude connect over OAuth 2.0: the user is sent to a CalcForms consent page, signs in there, and the assistant receives a short-lived access token and a refresh token for that user's account. CalcForms never receives the user's ChatGPT or Claude credentials.
Tokens are scoped to one account and carry the same row-level security as a dashboard session. A user can disconnect the connector from ChatGPT or Claude at any time, which stops further access. CalcForms does not connect to third-party accounts on your behalf and does not store tokens for other services.
Public form submission and email-sending endpoints are rate-limited per address and per form, forms carry a honeypot field, and outbound webhooks are validated against private and internal network ranges before delivery. Web pages are served with a content security policy and standard browser hardening headers.
Every webhook delivery can be verified. When a secret is set, each request carries an X-CalcForms-Signature header containing an HMAC-SHA256 of the raw body. Details are in the documentation.
Forms and submissions are kept for as long as your account is active. You can delete forms and individual submissions from the dashboard at any time. Website analytics are first-party and cookie-free; raw records are deleted after 90 days and only daily totals are kept. To delete an account and everything in it, email security@badabingapp.cc.
Every change to CalcForms ships through a reviewed pull request and an automated pipeline that verifies the live site after each deploy. The pipeline includes a check that the sign-in and OAuth surfaces have not changed unless the change was declared, so authentication cannot drift by accident. A daily check compares production against the repository and alerts us if anything was changed outside that process.
We run internal security reviews of the code and of the live database policies. The most recent reviews found and fixed issues in tenant isolation and public read access; each fix was verified against production before it was recorded. We do not currently hold a SOC 2 report or an external penetration test. If your procurement process needs one, tell us and we will say plainly where we stand.
If you believe you have found a security issue, email security@badabingapp.cc with enough detail to reproduce it. We acknowledge reports within two business days and will tell you when the issue is fixed. Please do not access data that is not yours while investigating; a proof of concept against your own account is enough.