Security
Your answers, kept safe.
People trust your forms with their names, emails and files. Here is exactly how Tapzy protects them, in plain words.
Updated October 2026
Accounts
- Passwords are hashed with bcrypt. We never store or see them in plain text.
- Sessions use secure, HTTP-only cookies that expire on their own.
- All traffic to Tapzy is sent over HTTPS.
Files people upload
- Files sent through your forms are kept in private object storage (Cloudflare R2), never in a public folder.
- They are opened through short-lived signed links, so a file's address can't be guessed or shared for long.
Verified respondents
- Ask for a 6-digit code sent by email before a form can be sent.
- Or a code by SMS, sent through your own Twilio account.
- Codes are checked on our server, so a response can't skip the step by editing the page.
Spam protection
- A hidden honeypot field catches bots that fill in every box.
- Submissions are rate-limited per IP address, and repeat sends from the same browser are checked.
- Anything that slips through can be marked as spam in one click.
Password-protected content
- Lock a form, a bio page or a short link with a password. Passwords are stored hashed.
- Attempts to unlock a form are rate-limited, so guessing doesn't scale.
Integrations and webhooks
- Every webhook is signed. Check the
Tapzy-Signatureheader to know it came from us. - Google Sheets, HubSpot and Notion can be set to receive verified responses only.
- Integrations only run when you connect them, and you can disconnect them at any time.
Tracking tags
- Google Tag Manager gets events like form view, start and submit. Answers are never sent to the dataLayer.
- Meta Pixel events name the form, never the respondent's email or number.
- Turn on a Consent Mode v2 banner so your tags wait for the visitor's choice.
Payments
- Payments in forms run on Stripe or Dodo Payments checkout, connected to your own account.
- Card numbers go straight to the payment provider. Tapzy never sees or stores them.
Your data stays yours.
Export any time
Download every response as a CSV file whenever you like. No plan locks your data in.
What we don’t claim
Tapzy doesn’t hold SOC 2 or ISO 27001 certifications today. We would rather tell you that than show a badge we haven’t earned. How we handle personal data is in our privacy policy.
Found a security issue?
Please email hello@tapzy.io with the details and how to reproduce it. We’ll reply quickly and keep you updated until it’s fixed. Please don’t test against other people’s accounts or data.
Collect form responses you can trust.
Spam protection on every form, plus email and SMS verification on Pro. Free trial, no credit card.