Security & compliance

Security overview

What Questionful actually does to protect your data.

A specific list rather than a reassuring one. If a control is not here, assume we have not built it.

Accounts

Passwords are stored hashed, never in plain text.
New accounts must confirm their email address before the dashboard, plan selection, or the JSON endpoints open.
Changing your email or password requires your current password. An email change is only applied once the new address confirms it, and the old address is notified of the request.
Two-factor authentication is available: a six-digit code emailed at sign-in, valid ten minutes, locked out after five wrong attempts. It is not an authenticator app, and there are no recovery codes.
Deactivated accounts cannot sign in and existing sessions stop working.
The forgot-password form is rate limited and does not reveal whether an address has an account.

Public forms

Cloudflare Turnstile blocks automated submissions on public forms and on the sign-in, registration, and password-reset pages.
The renderer can be restricted to an allow-list of domains.
Upload, download, and file-size endpoints are rate limited per IP.
A form has a cap on the number of files it can hold (2000), independent of the storage quota. A byte allowance alone does not bound the number of rows.
A webhook or integration URL must be a publicly reachable address. Addresses inside our own network are refused, so a form cannot be used to make our server call something internal.

Uploaded files

Files live on private object storage in the EU, encrypted at rest and versioned, with public access to the bucket blocked, never on a web-served disk.
Reading a respondent’s upload requires a session with access to the form, or a signed link that expires. A file ID on its own returns a 404. The existence of an ID is itself information.
Images the form owner placed in the form are public, because every respondent has to see them.
Links the app emits outside itself (integration payloads, PDFs, emailed copies) are signed.
Files served from public storage carry Content-Security-Policy: sandbox and nosniff, so an uploaded SVG cannot run script on our origin.

Responses

A submitted response can only be viewed or edited by the person who submitted it, not by anyone holding the link.
A CSV export escapes any answer that a spreadsheet would otherwise run as a formula.
A form’s confirmation message is rendered as text, never as markup.
The “email me a copy” option can be used once per response, and a form’s notification recipients are validated, neither can be used to send mail to arbitrary addresses.

The application itself

Security headers are set on every response, including file downloads and JSON replies.
Sign-in, sign-up, password reset, two-factor codes and the upload endpoints are all rate limited.
Actions that change or destroy something require a request from inside the app, so another site cannot trigger them with your session.

Audit trail

Every change to a form is recorded with the actor and a timestamp, and kept for a retention period configured on the account (30 days by default).

Payments

Card details are handled by Stripe and never reach our servers.

What we do not claim

We hold no SOC 2, ISO 27001, or comparable certification. We do not offer a contractual uptime SLA. We are a small team in Germany building in the open. If that is a blocker for your procurement process, say so early rather than late.

Reporting a vulnerability

Email support@questionful.org with a description and steps to reproduce. We acknowledge every report within two business days.