#Security boundaries

This page describes the intended Phase 1 product contract. It is not a certification or audit claim.

• Account sessions use secure host-only HTTP-only cookies in production.
• Public submission endpoints never accept FormRoost account cookies.
• Server API secrets are shown once, stored as digests, scoped to one project and environment, and accepted only through Authorization headers.
• Webhook signing material is application-encrypted at rest.
• Logs omit raw form payloads, credentials, cookies, authorization headers, and submitter personal data by default.
• Customer content remains in PostgreSQL and is not sent to third-party analytics or search vendors.
• Abuse rate limits store short-lived HMAC-derived network keys rather than raw IP addresses.
• Production webhook delivery blocks internal-address targets, revalidates DNS for every attempt, pins the connection to a validated address, and verifies TLS against the original hostname.
• Password re-entry creates a ten-minute recent-authentication window for API-key, billing-simulator, password, and account-deletion changes.

FormRoost does not claim SOC 2, ISO 27001, HIPAA, PCI, GDPR certification, penetration-test status, or an uptime guarantee before those claims are independently supportable.