Security, explained
Your data. Your keys. Zero access.
Most form builders encrypt your data on their servers, where they hold the key and can read it whenever they choose. VerifID Forms encrypts before your data ever leaves the browser, with a key only you hold — so there is nothing for us to read, even if we wanted to.
3072-bit
RSA encryption
Protects each form’s private key.
AES-256
Data protection
Encrypts every individual response.
Zero
Server access
We cannot decrypt your data even if compelled to.
DPDP
Act compliant
Built around India’s Digital Personal Data Protection Act.
The encryption flow, step by step
Each form gets its own key pair the moment you create it. The private key is generated client-side and is yours to keep — we never store it, see it, or transmit it to our servers.
Create a form
Design your custom form with various fields.
Publish the form
Make the form accessible to users via a link.
Save private key
Securely download or copy your unique private key. Do not lose it.
Collect responses
Users submit their responses, which are encrypted and stored.
View submissions
Upload or paste your saved private key to decrypt and access the data.
Secure data delivery
Your decrypted data is securely delivered and presented for analysis.
The tradeoff worth understanding
Because we never hold your private key, we cannot recover it if it is lost. That is not a missing feature — it is the same property that keeps your data unreadable to us. Store your key somewhere durable the moment you create a form.
Built around regulatory requirements
For organizations that need to answer to a compliance team, not just their own judgment.
HIPAA-Ready
Built with HIPAA’s technical safeguards in mind for healthcare data.
ISO 27001 Infrastructure
Hosted on infrastructure aligned with ISO 27001 controls.
GDPR Compatible
Supports the data minimization and access principles GDPR requires.
SOC 2 Hosting
Runs on hosting infrastructure with SOC 2 attestations.
Looking for region-specific detail? DPDP (India), HIPAA, GDPR, and PDPA breakdowns are each covered on their own page.
Questions worth asking before you trust us with sensitive data
What does "zero-knowledge" actually mean here? ▾
Every form gets its own encryption key pair, generated in the browser when you create the form. The private key never touches our servers. Response data is encrypted client-side with AES-256 before it is ever transmitted, so what reaches our database is ciphertext we cannot read — not plaintext we promise not to look at.
What happens if I lose my private key? ▾
We cannot recover it for you. That is the direct tradeoff of zero-knowledge design: the same property that keeps us from ever seeing your data also means we have nothing to hand back if the key is lost. Store it in a password manager or other durable, secure location the moment you create a form.
Could VerifID Forms be compelled to hand over my data? ▾
We could be compelled to hand over whatever we hold — which is encrypted ciphertext we cannot decrypt ourselves. Without your private key, that data is not meaningfully readable by us or by anyone we might be required to give it to.
How is this different from Google Forms or Typeform encrypting data "at rest"? ▾
Encryption at rest means the provider encrypts your data on their servers, but they hold the key — they can decrypt it whenever they choose, and so can anyone who compels them to. VerifID Forms encrypts before the data ever leaves the browser, with a key only you hold. We are never in a position to decrypt it at all.