Security
Last updated: 31 Oct 2026
This page summarizes how FormKlar protects forms and submissions in the current product. It mirrors what the software actually does on Cloudflare.
Edge architecture
The app is a Cloudflare Worker: request handling runs at the edge close to visitors. Form configuration and submissions persist in Cloudflare D1. There is no separate origin app server holding a second copy of your inbox for the core path.
Transport security (TLS)
www.formklar.com is served over HTTPS. Browsers connect with TLS terminated on Cloudflare’s network.
Access control
The console and form APIs require a signed-in Google account session (HttpOnly cookie). Each form is owned by a user; list/edit/delete/submission APIs check ownership before returning data. Public submit endpoints accept only the published form’s submissions and do not expose other users’ inboxes.
Bot and abuse controls
Public submits can require Cloudflare Turnstile. We also use honeypot fields and IP-hash based rate limiting to reduce automated abuse. These controls protect availability; they are not a substitute for your own content policies.
No file uploads
FormKlar fields are structured text/choice/hidden values. File upload is not supported, which shrinks malware and accidental sensitive-file exposure through the form channel.
Billing isolation
Pro payments are processed by Paddle as Merchant of Record. Card data is handled by Paddle, not stored in FormKlar’s D1 database.
Contact: notify@formklar.com · Privacy