Your clients trust you with personal and financial details, and you trust OneForm with them. This is a short summary of how OneForm protects that data. The full details are on the Security page.
Where your data lives
The website, the app, its database and stored files run on Railway, in its us-east4 region in Virginia. Cloudflare sits in front of them for DNS and a web application firewall, which filters attacks and automated traffic before they reach OneForm. Your firm's data is stored and processed in the United States.
The database is backed up daily by OneForm's hosting provider.
How it's encrypted
- Every connection to the website, the app and the API is encrypted in transit with TLS.
- Access tokens for the apps you connect, and webhook signing secrets, are encrypted at rest with AES-256-GCM. Each one is tied to its firm.
- API keys and AI agent tokens are stored only as hashes. OneForm can check one, but can't read it back.
- Passwords are salted and hashed with scrypt, and checked against known breaches in a way that never sends the password.
- Links sent to clients are signed, so they can't be altered or guessed.
Who at OneForm can see it
Only a few people at OneForm can open a customer's account, and only to give support you ask for, keep the service secure, or comply with law. Their access is limited to those purposes and audited. When OneForm staff open your firm, it's recorded in your audit log, so you can see who looked and when.
Other protections
- People approve, not the AI. By default, every report waits for someone on your team before it's sent.
- Voices aren't kept. Voice forms save the answers, never the recordings.
- No keys to paste. Live integrations connect with OAuth, so passwords and API keys never pass through a form.
- Abuse limits. Public forms are rate-limited, and admin actions are protected against cross-site requests.
Tax return information
OneForm handles the tax return information firms collect on the basis that it may be treated as a tax return preparer under IRC §7216. It uses and discloses clients' answers only to provide the service to the firm that collected them. It doesn't sell them, use them for advertising, or use them to train AI models. Your firm is responsible for getting any consent your clients must give. See the Security page's §7216 section and Taxpayer consent for AI.
Good to know
- SOC 2. OneForm is working toward a SOC 2 Type II report and doesn't hold one yet. OneForm is happy to answer your firm's security questionnaire. Get in touch.
- Who else processes data. The companies that help run OneForm, what each one does and where, are on the Subprocessors page.
- Policies. See the Privacy Policy and the Data Processing Addendum.
How do I report a security problem?
Email security@oneform.si, or choose Security in the contact form. Say what you found, where, and how to reproduce it. OneForm acknowledges reports within 2 business days. The Security page has the full policy.