VerifID Forms: Privacy-First Forms for GDPR Data
Zero-knowledge encryption that supports the technical side of GDPR: data protection by design and security of processing.
Zero Knowledge Zero-Knowledge Architecture: Technical Sovereignty
To meet the GDPR “Privacy by Design” mandate, VerifID Forms employs a Zero-Knowledge Architecture. Your data is encrypted on the client side using RSA-3072 for secure key exchange and AES-256 for data encryption. This ensures that personal data is encrypted before it leaves your browser. Because we do not store or have access to your private decryption keys, we are mathematically incapable of accessing the contents of your forms. This provides a level of security that exceeds traditional server-side encryption standards.
Built to Satisfy Core Mandates
Technical operations optimized specifically for compliance engineers and legal boundaries.
Right to Portability
Users can export their personal data in machine-readable JSON/CSV formats instantly to satisfy Article 20.
EU Data Residency
Optional data pinning to EU-based servers to simplify cross-border transfer compliance for your organization.
AES-256 E2EE
State-of-the-art technical measures ensuring data is unintelligible to any unauthorized third parties.
DPA Management
Pre-signed Data Processing Agreements (DPA) available to formalize your compliance chain.
Privacy by Design & Default
How our technology infrastructure matches up directly with legal requirements.
Article 32: Security of Processing
Implementation of state-of-the-art encryption and pseudonymization techniques ensuring levels of security appropriate to the risk.
Articles 15-21: Subject Rights
Only the form owner can read responses, so you find, export or erase a person's data yourself, and erasure is verifiable because you hold the key. A rights-request portal is on our roadmap, not built yet.
Article 33: Breach Notification
Stored responses are ciphertext, so a breach of our storage exposes nothing readable. The 72-hour notification duty stays with your organisation as controller.
The General Data Protection Regulation (GDPR)
The GDPR is a comprehensive privacy law requiring organizations to adopt a ‘Privacy by Design’ framework. VerifID Forms facilitates this by providing technical safeguards that automatically enforce data minimization, secure storage, and total transparency. By utilizing our zero-knowledge architecture, you significantly reduce your compliance overhead as encryption keys never leave the control of the client, ensuring the highest standards of user data protection.
Frequently asked questions
Does VerifID Forms help with GDPR compliance? â–¾
It supports the technical side. Client-side encryption implements 'data protection by design and by default' (Article 25): personal data is encrypted in the browser and the platform never holds the key. Erasure is verifiable because only the form owner holds the key. You still need your own lawful basis, notices and a process for access and rectification requests (Articles 15 to 21); a rights-request portal is on our roadmap, not built yet.
Where is the data stored, and is EU data residency available? â–¾
Submissions are currently stored in AWS's Mumbai (India) region. EU-region storage is not available yet; contact us if you need it. Because responses are stored as ciphertext the platform cannot read, residency is about jurisdiction and latency rather than exposure.
Do you offer a Data Processing Agreement (DPA)? â–¾
A DPA covering VerifID Forms' role as a processor is available on request for business customers; email us and we will send it. The zero-knowledge architecture means the scope of processing on our side is limited to storing and transmitting encrypted data.
How does encryption support the right to erasure? â–¾
The form owner holds the only decryption key. Deleting a response removes the stored ciphertext, and destroying the key renders any residual copies permanently unreadable, so erasure requests are simple to fulfil and demonstrate.
Can we collect explicit consent for special category data? â–¾
Yes. Forms support separate, un-ticked consent statements per purpose, plus a linked privacy notice at the point of collection, which is the structure GDPR expects for explicit consent.