Data Privacy
Privacy Friendly
Built with privacy in mind with no third-party cookies, fingerprinting, or invasive tracking.
- IP addresses (country is resolved server-side at the network edge, and the raw IP never reaches our servers)
- Device fingerprints (no Canvas, WebGL, or storage-based fingerprinting)
- Social profiles (no Twitter, Discord, or email collection)
- Third-party cookies
Transparency
Open Source
Formo SDKs are 100% open source with a fully permissive MIT license.
Compliance
SOC 2 (in progress)
Formo’s SOC 2 compliance report will be available on request.
Supply Chain Security
NPM Trusted Publishing
Eliminates security risks from long-lived write tokens, which can be compromised.
Subresource Integrity
Formo supports SRI, which helps prevent attacks like cross-site scripting (XSS) and NPM hijacking.
Content Security Policy
Formo supports CSP, which helps prevent attacks like cross-site scripting (XSS) and data injection.
Minimal Dependencies
Having fewer runtime dependencies significantly reduces the supply chain attack surface.
SDK Dependencies List
The @formo/analytics SDK maintains a minimal dependency footprint to minimize attack surface:
All releases include cryptographic provenance attestations linking each npm package to its GitHub source code.
Secure Installation Methods
There are two ways to install the Formo SDK, each with different security properties:
For the CDN script tag method, enable SRI and CSP for equivalent protection. See the complete secure installation guide.
Infrastructure Security
Encryption in Transit
All connections secured with industry-standard TLS 1.2+ encryption.
Encryption at Rest
All data volumes, including backups, are encrypted at rest with unique AES-256 keys.
Backups
All customer databases are continuously backed up to highly durable storage.
Data Center Security
Formo runs on AWS, which has the highest levels of security and reliability.
Monitoring
24/7 on-call rotations with internal escalations monitor across all systems.
Software Security
Quality Assurance
Automated tests and code reviews run after each code change as part of QA.
Security Reviews
Engineering review for security best practices to address potential security threats.
Vulnerability Management
Formo conducts regular penetration tests in addition to internal security reviews.
Partner Security
Payments and PCI
Formo uses Paddle to process payments and does not store credit card information.
Subprocessors
Formo keeps the list of data subprocessors updated in the Terms of Service.
Access Control
Single Sign-On (SSO)
SAML-based SSO allows centralized authentication through your identity provider.
Multi-Factor Authentication
MFA adds an additional layer of security to user accounts and workspaces.
Role Based Access Control
RBAC enforces the least privilege principle on users based on specific roles.
Audit Logs
Every action in a workspace produces an audit log record. Owners and Admins can review the workspace audit log.
Others
Changelog
Formo publishes a weekly summary of updates and fixes.
FAQ
Does Formo store IP addresses or use device fingerprinting?
Does Formo store IP addresses or use device fingerprinting?
No. Formo does not store IP addresses, use device fingerprinting, or set third-party cookies. See what we collect for a full breakdown of the data Formo processes.
Is the Formo SDK open source? Can I audit the code?
Is the Formo SDK open source? Can I audit the code?
Yes. The Formo SDK is fully open source on GitHub. You can audit the code, verify what data is collected, and contribute improvements.
How should I install Formo for maximum security?
How should I install Formo for maximum security?
Use Subresource Integrity (SRI) to verify SDK integrity, configure a Content Security Policy (CSP) to control allowed domains, and set up a reverse proxy to route requests through your own domain.
Does Formo support SSO and role-based access control?
Does Formo support SSO and role-based access control?
Yes. Formo supports Single Sign-On (SSO) for centralized authentication through your identity provider, multi-factor authentication (MFA) via TOTP, and role-based access control with Owner, Admin, Editor, and Viewer roles.