Built for Developer Trust
How Form2Lead secures form payloads, blocks endpoint abuse, and handles customer submission data.
How does Form2Lead protect incoming form submissions?
Form2Lead protects form data using TLS 1.3 encryption in transit, Neon database isolation at rest, strict CORS origin list verification, and Upstash Redis rate-limit throttling.
Encryption in Transit & At Rest
All HTTP submission endpoints require HTTPS with TLS 1.3 encryption. Submission records are persisted in Neon PostgreSQL databases with strict access controls.
CORS & Allowed Domain Locking
Lock your form endpoint to specific hostnames (e.g. yourdomain.com) so unauthorized third-party sites cannot submit fake leads to your API.
Distributed Rate Limiting
Upstash Redis rate limiters automatically throttle high-frequency submission spikes to prevent denial-of-service abuse and endpoint flooding.
Data Privacy & Retention Controls
Export or permanently delete submission records at any time from your dashboard. Retention rules automatically clear old logs according to your plan tier.
Responsible Disclosure Policy
We welcome reports from security researchers. Please review our standardized RFC 9116 security policy at /.well-known/security.txt.