What security and privacy measures does Youform have in place?
Updated 2 days ago
Last reviewed: 27 October 2026
Youform uses the security practices described below to protect account and form data. For the current service-provider list, processing locations, and data-protection roles, see our GDPR article.
Current security practices
HTTPS encryption: communication between your browser and our servers is encrypted over HTTPS.
Encryption at rest: our database and cloud storage use encryption at rest.
Automatic database backups: we make daily database backups to support recovery. Backup rotation and permanent deletion of retained records are separate processes; see the retention explanation in our GDPR article.
Server and framework protections: these include OS and framework updates, network protections, input validation, and rate limiting.
Hosting and access controls: our primary application infrastructure uses AWS, with infrastructure access controls and encrypted storage.
Storage and processing locations
Our primary application and database hosting is in Ireland (EU). Uploaded files and database backups use Cloudflare R2; the current bucket is in Asia-Pacific (APAC). Cloudflare's network and other service providers may process data in additional countries. Youform does not provide an EU-only storage or processing guarantee.
See GDPR: service providers and subprocessors for the current list and optional integrations.
Can Youform be self-hosted?
No. Youform is a hosted service that we run for you, and it cannot be installed on your own servers or infrastructure. Your data stays with Youform as described in our GDPR article.
If self-hosting is a requirement for your project, contact us at [email protected] and tell us about your needs.
GDPR and our Data Processing Agreement
GDPR is a legal framework. The location of a server alone does not establish GDPR compliance. Youform provides account controls and a Data Processing Agreement (DPA) to support customers' data-protection obligations. The form creator is normally the controller of respondent data, and Youform acts as a processor for that data.
Compliance roadmap
Our published roadmap lists the following as planned:
SOC 1 and SOC 2: planned.
HIPAA support: planned.
These roadmap items are not claims that Youform currently holds those certifications or is HIPAA compliant. We will update our documentation as the status changes.
Privacy policy and terms
If you have security or privacy questions, contact [email protected].