How we protect your data.

The application and primary database run on Microsoft Azure in the Central India region, and our email service stores data in India. Other providers help us run the service, each with its own location:

Sign-in data is held in Microsoft Entra External ID's Asia-Pacific identity geography. Some providers, such as Cloudflare and Google Fonts, operate global networks and may process data outside India. The full list, with the personal data each one handles, is on our sub-processors page.

• The application and primary database run on Microsoft Azure in the Central India region.
• The PostgreSQL database is reachable only on a private network; public access is disabled.
• Data is encrypted in transit with TLS (HTTPS everywhere, with HSTS) and encrypted at rest by our cloud providers.
• Application secrets live in Azure Key Vault and are read through managed identities, never stored in code.
• Containers run as a non-root user; releases go through automated tests before deployment.

Everything you build lives in a workspace. Teammates join with one of four roles, and the database checks every request against that role, not just the interface:

Owner

Full control, including billing and deleting the workspace.

Admin

Invite members, edit forms, view responses.

Editor

Edit forms and responses. Can't manage members.

Viewer

View forms and responses. Can't edit anything.

• The application connects with a restricted database role: no ownership, no superuser rights, and row-level security on tenant data. In plain terms, the database itself only hands back rows that belong to a workspace you are a member of. Schema changes use a separate identity that the running application cannot read.
• Workspace roles (owner, admin, editor, viewer) are enforced in the database, not just in the interface.
• Sign-in is handled by Microsoft Entra External ID; we never see passwords. Session tokens and API keys are stored only as hashes.
• Staff access to production is limited to people who need it, and operator actions are recorded in an audit log.

• Uploaded files are stored privately and shared only through short-lived signed links. Upload and download links expire within minutes.
• Before a file is kept, we check that its contents match the file type it claims to be, independently of what the browser reports.
• Verified files are moved to a location no browser has permission to write to.
• Uploads that are never attached to a response are deleted after a day.

• Public endpoints are rate limited and published forms use a honeypot and Cloudflare Turnstile bot check.
• CSV exports neutralise spreadsheet formulas to prevent injection.
• Found a form that phishes, scams or abuses people? Anyone can report a form. Reports go straight to our Grievance Officer.

Webhook signing secrets are encrypted at rest; outgoing webhooks are signed. Each delivery carries an HMAC-SHA256 signature over the timestamp and the body, computed with that webhook's own secret. Your endpoint can recompute it and reject anything that doesn't match or is too old.

x-webhook-id: <event id>
x-webhook-timestamp: 1761100000000
x-signature-256: sha256=HMAC_SHA256(secret, timestamp + "." + body)

Integrations and webhooks

• Subscriptions, credit packs and payments inside forms all go through Razorpay's checkout. Card and UPI details are entered with Razorpay and stay with Razorpay.
• We store only payment status and Razorpay order, payment and subscription IDs, and we verify Razorpay's payment signature before recording a payment.
• Payments in your forms use your own Razorpay account and settle there; SOYL never holds the money.

• Answers typed into form fields are never sent to AI providers.
• If a respondent chooses to ask the form's assistant a question, the message they type there is sent to our AI provider to answer it.
• When you use AI drafting or brand extraction, only what you provide (your description, notes, brand documents or website) is sent to generate the result.
• We do not use customer data to train AI models, and under our provider's terms prompts and outputs are not used to train its models.
• AI drafts never publish on their own: you review every form before it goes live.

• Export responses as CSV from any form at any time.
• Download my data: account holders can download a machine-readable copy of the personal data we hold about them from Account settings.
• Delete forms, responses and brand kits whenever you like. Deleted responses are erased, not hidden.
• Delete your whole account from Account settings in the app or on the website (how to delete your account). We disable it immediately and permanently remove your data shortly afterwards, usually within a day, except records the law requires us to keep, such as invoices. Deleted data disappears from our encrypted backups when they expire, within 14 days.

The complete schedule, with the purpose and legal basis for each kind of data, is in our privacy policy (sections 3 and 10).

• We keep security and system logs for 180 days to investigate incidents, as required by CERT-In.
• The database has automated point-in-time backups, retained for 14 days, and we test restoring them.
• We report cyber security incidents to CERT-In within 6 hours of noticing them and notify affected customers without undue delay (see our Data Processing Addendum).
• If a personal data breach affects you, we tell you what happened, the likely consequences, what we are doing and what you can do. For breaches affecting form responses, we notify the publisher within 24 hours of confirming the breach so they can inform respondents.
• Once the DPDP Rules' breach provisions apply (from 13 May 2027), we will notify the Data Protection Board of India within 72 hours.

If you believe you have found a security vulnerability, email [to be confirmed] with the details and steps to reproduce it. Please:

• give us reasonable time to fix the issue before telling anyone else;
• use only test accounts and forms you own, and never access, change or delete other people's data;
• avoid denial of service, spam, social engineering and physical attacks.

We will acknowledge your report within 3 business days, keep you updated, and credit you if you wish. We will not pursue legal action against good-faith research that follows these rules. We do not currently run a paid bug bounty. Our machine-readable contact is at /.well-known/security.txt.