Security

VeilForms is built on a simple principle: we cannot read your data, so we cannot leak it.

This page details our security practices, encryption implementation, and how to report vulnerabilities.

Security Model Overview

VeilForms uses zero-knowledge encryption where form submissions are encrypted client-side before transmission:

  1. You generate an RSA keypair (you keep the private key)
  2. Users’ browsers encrypt form data with your public key
  3. We receive and store only encrypted ciphertext
  4. We cannot decrypt submissions (we don’t have your private key)
  5. You decrypt locally or on your server using your private key

Result: Even if our servers are compromised, encrypted submissions remain unreadable.

Encryption Standards

Client-Side Encryption

Algorithms:

Implementation:

Process:

1. Generate random AES-256 key (per submission)
2. Encrypt form data with AES-256-GCM
3. Encrypt AES key with recipient's RSA-2048 public key
4. Bundle encrypted data + encrypted key + metadata
5. Transmit bundle to VeilForms API

Transport Security

TLS 1.3 for all connections:

Storage Security

Data at rest:

Backups:

Infrastructure Security

Hosting and Isolation

Access Controls

Employee access:

API access:

Monitoring and Logging

Security monitoring:

Logs:

Application Security

Secure Development Practices

OWASP Top 10 Mitigations

VulnerabilityMitigation
InjectionParameterized queries, input validation
Broken AuthSecure session management, MFA support
Sensitive Data ExposureClient-side encryption, TLS 1.3
XML External EntitiesJSON-only API, no XML parsing
Broken Access ControlRBAC, API key scoping
Security MisconfigurationHardened defaults, security headers
XSSContent Security Policy, output encoding
Insecure DeserializationSafe parsers, schema validation
Using Components with Known VulnerabilitiesAutomated scanning, rapid patching
Insufficient LoggingComprehensive audit trails

Security Headers

All VeilForms pages include:

Content-Security-Policy: default-src 'self'; script-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Strict-Transport-Security: max-age=31536000; includeSubDomains

Authentication and Authorization

User Authentication

API Authentication

Compliance and Certifications

Current Compliance

Security Roadmap

Audit Reports

Once completed, audit reports will be available to Enterprise customers under NDA.

Vulnerability Disclosure

We welcome security researchers to help keep VeilForms secure.

Responsible Disclosure Process

  1. Email: security@veilforms.com (PGP key available)
  2. Include: Detailed description, reproduction steps, impact assessment
  3. Response: We’ll acknowledge within 24 hours
  4. Fix: Critical issues patched within 7 days
  5. Disclosure: Coordinated public disclosure after fix

Security Bug Bounty

We offer rewards for qualifying vulnerabilities:

SeverityBounty
Critical (RCE, encryption bypass)$500-$2,000
High (XSS, auth bypass)$200-$500
Medium (CSRF, info disclosure)$50-$200
Low (minor issues)Hall of Fame

In scope:

Out of scope:

Rules:

Hall of Fame

We’ll publicly recognize researchers who help improve VeilForms security (with permission).

Incident Response

In Case of a Breach

If we detect a security incident:

  1. Immediate containment (within 1 hour)
  2. User notification (within 24 hours if affected)
  3. Regulatory notification (as required by law)
  4. Public disclosure (full transparency report)
  5. Remediation (permanent fix + preventive measures)

Your encrypted data remains protected even in a breach (we can’t decrypt it).

Breach History

No security incidents to date. This section will be updated if any occur.

Key Management Best Practices

Since you control the encryption keys, here are our recommendations:

For Individuals

For Teams

For Enterprises

Security Contact

Report vulnerabilities: security@veilforms.com

PGP Key: Download PGP key (Fingerprint: [FINGERPRINT])

General security questions: support@veilforms.com

Emergency contact: [Phone number for critical issues]

Additional Resources

External Security Resources

Security Changelog

December 2025:

Future updates will be logged here.

Trust but Verify

Don’t just take our word for it:

  1. Inspect the SDK: Our open-source JavaScript SDK is fully auditable
  2. Check network traffic: Verify only encrypted data is transmitted
  3. Test decryption: Confirm you can decrypt submissions locally
  4. Review headers: Use browser dev tools to inspect security headers

Security is a partnership. We build the infrastructure; you verify it works.

Last updated: December 13, 2025

Next security review scheduled: March 2025