Security
How we protect your data and your forms
Authentication
- Google OAuth 2.0 — we never see or store your Google password. Authentication is handled entirely by Google.
- JWT tokens — sessions use signed JSON Web Tokens with 30-day expiration stored in your browser's localStorage.
- Token rotation — Google refresh tokens are rotated automatically and stored encrypted.
Data Encryption
- In transit: All communication uses TLS 1.2+ (HTTPS). No plain HTTP.
- At rest: Data stored on Google Cloud infrastructure with AES-256 encryption.
- Payments: Card data is never stored by us — handled entirely by Stripe (PCI DSS Level 1 certified).
Google API Access
- We request only the minimum Google API scopes required to operate.
- Forms and sheets are created in your Google Drive — we do not store your form content on our servers beyond what's needed to display it in the app.
- You can revoke our access at any time at myaccount.google.com/permissions.
Infrastructure
- Backend: Google Cloud Run — auto-scaling, isolated containers, built-in DDoS protection.
- Frontend: Vercel — global CDN, automatic HTTPS, isolated deployments.
- Access control: Production systems accessible only via authenticated service accounts.
Responsible Disclosure
If you discover a security vulnerability, please report it responsibly to contact@intakeforge.com. We will acknowledge your report within 48 hours and work to resolve confirmed issues promptly.
Your Responsibilities
- Keep your device and browser secure.
- Log out of shared devices after use.
- Do not share your session token with anyone.
- If you believe your account is compromised, revoke Google access immediately and contact us.