Security

Last updated October 20, 2026

Formfile handles other people's files, so here is exactly how it's built.

• Least access to your Drive. Formfile uses Google's drive.file permission. It only touches the folders and files it creates for your forms.
• No copies. Uploads stream straight into your Drive. Nothing is stored on Formfile's servers, and pending uploads that are never submitted are deleted from your Drive after 24 hours.
• Encrypted tokens. The Google refresh token that lets Formfile write to your Drive is encrypted with AES-256-GCM. The key is held separately from the database.
• HTTPS everywhere. Every page and upload goes over TLS.
• Blocked file types. Executables and scripts (.exe, .msi, .js, .bat, .apk and similar) are refused before upload.
• Abuse controls. Uploads and submissions are rate-limited, every form shows a report link, and forms used for phishing are switched off.
• Revoking access. You can disconnect Formfile at any time from your Google account (Security, Third-party access). Formfile will stop being able to add files immediately.

Found a vulnerability? Email hello@formfile.app. We reply within a day.